Skip to content

Context doesn't get cleaned up after being used #34

@rilysh

Description

@rilysh

Hello,
The finalizing function of hash algorithms doesn't clean up their previously used buffers, as a result, anyone is able to read the data from the context. This is a bad thing as if it's being used to create private hashes, it might be possible that someone can snoop the context and retrieve the hash later.

A small solution would be purging everything with explicit memset function after calling the final function, and only keeping the hash to its target location.

Something like: memset(ctx, 0, sizeof(*ctx)); at the end of the final function.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions