From: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>
Date: Thu, 14 Nov 2024 04:38:27 +0000 (+0000)
Subject: fips: zeroize temporary self-check out MD variable
X-Git-Tag: openssl-3.5.0-alpha1~886
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5946465a8745069afc6db1135e42a3cd718a37dc;p=thirdparty%2Fopenssl.git

fips: zeroize temporary self-check out MD variable

At least this is done on module startup only.

To satisfy ISO/IEC 19790:2012/Cor.1:2015(E) Section 7.5 [05.10]
requirement.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25945)
---

diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c
index 551fadecdec..f4fd3f51ae3 100644
--- a/providers/fips/self_test.c
+++ b/providers/fips/self_test.c
@@ -289,6 +289,7 @@ err:
     OSSL_SELF_TEST_onend(ev, ret);
     EVP_MAC_CTX_free(ctx);
     EVP_MAC_free(mac);
+    OPENSSL_cleanse(out, sizeof(out));
     return ret;
 }
 #endif /* OPENSSL_NO_FIPS_POST */