commit 1b7d6f8c039574f5e85552da5e8d24eb0023050a
author Andres Amaya Garcia <andres.amayagarcia@arm.com> Mon Jun 26 11:35:17 2017 +0100
committer Andres Amaya Garcia <andres.amayagarcia@arm.com> Tue Jul 11 17:31:02 2017 +0100
tree 0c46982366cd82d6531e6a7fe1a349bf3ce7e579
parent 64f0e093163935b105a845a3abcb26fa16cd608b

Zeroize old psk buf when changing value in ssl_tls

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index bd2c270..09f6bfa 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5872,6 +5872,7 @@
 
     if( conf->psk != NULL || conf->psk_identity != NULL )
     {
+        mbedtls_zeroize( conf->psk, conf->psk_len );
         mbedtls_free( conf->psk );
         mbedtls_free( conf->psk_identity );
         conf->psk = NULL;
@@ -5907,7 +5908,10 @@
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     if( ssl->handshake->psk != NULL )
+    {
+        mbedtls_zeroize( ssl->handshake->psk, ssl->handshake->psk_len );
         mbedtls_free( ssl->handshake->psk );
+    }
 
     if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );