commit 466ebe8ced5719ec9bd25cc34e90a716e3965d3a
author Gilles Peskine <Gilles.Peskine@arm.com> Thu Mar 06 12:41:39 2025 +0100
committer Gilles Peskine <Gilles.Peskine@arm.com> Thu Mar 06 22:43:23 2025 +0100
tree 13df6cf9e24f309e3d8093b3cf608b5ce222ec8a
parent c43a9d5576c3f9b9da21454711c104b1f9d73efa

Zeroize temporary heap buffers used in PSA operations

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

ChangeLog.d/psa-zeroize.txt

diff --git a/ChangeLog.d/psa-zeroize.txt b/ChangeLog.d/psa-zeroize.txt
new file mode 100644
index 0000000..e597302
--- /dev/null
+++ b/ChangeLog.d/psa-zeroize.txt
@@ -0,0 +1,2 @@
+Security
+   * Zeroize temporary heap buffers used in PSA operations.

library/psa_crypto.c

diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 21d8420..755465e 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -6171,16 +6171,22 @@
     return PSA_SUCCESS;
 
 error:
-    mbedtls_free(local_input->buffer);
-    local_input->buffer = NULL;
+    if (local_input->buffer != NULL) {
+        mbedtls_platform_zeroize(local_input->buffer, local_input->length);
+        mbedtls_free(local_input->buffer);
+        local_input->buffer = NULL;
+    }
     local_input->length = 0;
     return status;
 }
 
 void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input)
 {
-    mbedtls_free(local_input->buffer);
-    local_input->buffer = NULL;
+    if (local_input->buffer != NULL) {
+        mbedtls_platform_zeroize(local_input->buffer, local_input->length);
+        mbedtls_free(local_input->buffer);
+        local_input->buffer = NULL;
+    }
     local_input->length = 0;
 }
 
@@ -6223,8 +6229,11 @@
         return status;
     }
 
-    mbedtls_free(local_output->buffer);
-    local_output->buffer = NULL;
+    if (local_output->buffer != NULL) {
+        mbedtls_platform_zeroize(local_output->buffer, local_output->length);
+        mbedtls_free(local_output->buffer);
+        local_output->buffer = NULL;
+    }
     local_output->length = 0;
 
     return PSA_SUCCESS;