Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #define PORT_Memset memset
- static SECStatus ssl2_ClientSetupSessionCypher(....)
- {
- ....
- PRUint8 keyData[SSL_MAX_MASTER_KEY_BYTES];
- ....
- loser2:
- done:
- PORT_Memset(keyData, 0, sizeof(keyData));
- PORT_ZFree(ekbuf, modulusLen);
- PORT_ZFree(eblock, modulusLen);
- SECKEY_DestroyPublicKey(serverKey);
- return rv;
- }
- This suspicious code was found in NSS project by PVS-Studio static code analyzer.
- Warning message is:
- V597 The compiler could delete the 'memset' function call, which is used to flush 'keyData' buffer. The RtlSecureZeroMemory() function should be used to erase the private data. sslcon.c 2151
- PVS-Studio is a static analyzer for detecting bugs in the source code of applications written in C, C++, C++11, C++/CX. Site: http://www.viva64.com/en/pvs-studio/
Advertisement
Add Comment
Please, Sign In to add comment