commit b23b04d1777074d340e64fb137016bf74414e168
author Andrzej Kurek <andrzej.kurek@arm.com> Tue Mar 20 05:02:29 2018 -0400
committer Andrzej Kurek <andrzej.kurek@arm.com> Tue Mar 20 05:02:29 2018 -0400
tree e11213c1f4ae80c20bc782a127c288aeeba3afcb
parent 686a05e90cb59dda0658db1dc3f20b4734e6b063

pkcs11: zeroize buffer earlier on failure

Change the buffer zeroization so that it happens earlier

library/pkcs11_client.c

diff --git a/library/pkcs11_client.c b/library/pkcs11_client.c
index 82cc0e1..1244f40 100644
--- a/library/pkcs11_client.c
+++ b/library/pkcs11_client.c
@@ -157,6 +157,8 @@
         goto exit;
     *sig_len = ck_sig_len;
 exit:
+    if( rv != CKR_OK )
+        memset( sig, 0, ck_sig_len );
     return( pkcs11_err_to_mbedtls_pk_err( rv ) );
 }
 #endif /* MBEDTLS_RSA_C */
@@ -226,8 +228,6 @@
         return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
     }
 
-    if( ret != 0 )
-        memset( sig, 0, *sig_len );
     return( ret );
 }