Merge pull request #733 from gabor-mezei-arm/689_bp27_zeroising_of_plaintext_buffers
[Backport 2.7] Zeroising of plaintext buffers in mbedtls_ssl_read()
diff --git a/ChangeLog.d/zeroising_of_plaintext_buffer.txt b/ChangeLog.d/zeroising_of_plaintext_buffer.txt
new file mode 100644
index 0000000..f618beb
--- /dev/null
+++ b/ChangeLog.d/zeroising_of_plaintext_buffer.txt
@@ -0,0 +1,4 @@
+Security
+ * Zeroising of plaintext buffers in mbedtls_ssl_read() to erase unused
+ application data from memory. Reported in #689 by
+ Johan Uppman Bruce of Sectra.
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 3b4bfad..79d8119 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -7407,6 +7407,10 @@
memcpy( buf, ssl->in_offt, n );
ssl->in_msglen -= n;
+ /* Zeroising the plaintext buffer to erase unused application data
+ from the memory. */
+ mbedtls_zeroize( ssl->in_offt, n );
+
if( ssl->in_msglen == 0 )
{
/* all bytes consumed */