Changeset 5990 for pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

Timestamp:

May 15, 2019 2:43:01 AM (5 years ago)

Author:

nanang

Message:

Close #2179: Wipe out memory used for storing SSL keys before released.

File:

• pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c (modified) (1 diff)

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -1052 +1052 @@
     }
 
+    /* Early sensitive data cleanup after OpenSSL context setup. However,
+     * this cannot be done for listener sockets, as the data will still
+     * be needed by accepted sockets.
+     */
+    if (cert && (!ssock->is_server || ssock->parent)) {
+        wipe_cert_buffer(cert);
+    }
+
     /* Create SSL instance */
     ossock->ossl_ctx = ctx;