Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Context doesn't get cleaned up after being used #34

Open
rilysh opened this issue Nov 17, 2023 · 0 comments
Open

Context doesn't get cleaned up after being used #34

rilysh opened this issue Nov 17, 2023 · 0 comments

Comments

@rilysh
Copy link

rilysh commented Nov 17, 2023

Hello,
The finalizing function of hash algorithms doesn't clean up their previously used buffers, as a result, anyone is able to read the data from the context. This is a bad thing as if it's being used to create private hashes, it might be possible that someone can snoop the context and retrieve the hash later.

A small solution would be purging everything with explicit memset function after calling the final function, and only keeping the hash to its target location.

Something like: memset(ctx, 0, sizeof(*ctx)); at the end of the final function.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant