From 2b561cb0e87f2ee535e8c64907883cd275ad3fec Mon Sep 17 00:00:00 2001
From: deraadt <>
Date: Tue, 2 May 2017 03:59:45 +0000
Subject: use freezero() instead of memset/explicit_bzero + free. 
 Substantially reduces conditional logic (-218, +82).

MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c
wasn'tt quite right.  Two other tricky bits with ASN1_STRING_FLAG_NDEF and
BN_FLG_STATIC_DATA where the condition cannot be collapsed completely.

Passes regress.  ok beck
---
 src/lib/libcrypto/pkcs7/pk7_doit.c | 34 +++++++++-------------------------
 1 file changed, 9 insertions(+), 25 deletions(-)

(limited to 'src/lib/libcrypto/pkcs7')

diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index 484620a686..24ab957b4c 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_doit.c,v 1.41 2017/01/29 17:49:23 beck Exp $ */
+/* $OpenBSD: pk7_doit.c,v 1.42 2017/05/02 03:59:45 deraadt Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -231,10 +231,7 @@ pkcs7_decrypt_rinfo(unsigned char **pek, int *peklen, PKCS7_RECIP_INFO *ri,
 
 	ret = 1;
 
-	if (*pek) {
-		explicit_bzero(*pek, *peklen);
-		free(*pek);
-	}
+	freezero(*pek, *peklen);
 
 	*pek = ek;
 	*peklen = eklen;
@@ -577,8 +574,7 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 			 */
 			if (!EVP_CIPHER_CTX_set_key_length(evp_ctx, eklen)) {
 				/* Use random key as MMA defence */
-				explicit_bzero(ek, eklen);
-				free(ek);
+				freezero(ek, eklen);
 				ek = tkey;
 				eklen = tkeylen;
 				tkey = NULL;
@@ -589,16 +585,10 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 		if (EVP_CipherInit_ex(evp_ctx, NULL, NULL, ek, NULL, 0) <= 0)
 			goto err;
 
-		if (ek) {
-			explicit_bzero(ek, eklen);
-			free(ek);
-			ek = NULL;
-		}
-		if (tkey) {
-			explicit_bzero(tkey, tkeylen);
-			free(tkey);
-			tkey = NULL;
-		}
+		freezero(ek, eklen);
+		ek = NULL;
+		freezero(tkey, tkeylen);
+		tkey = NULL;
 
 		if (out == NULL)
 			out = etmp;
@@ -623,14 +613,8 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
 	if (0) {
 err:
-		if (ek) {
-			explicit_bzero(ek, eklen);
-			free(ek);
-		}
-		if (tkey) {
-			explicit_bzero(tkey, tkeylen);
-			free(tkey);
-		}
+		freezero(ek, eklen);
+		freezero(tkey, tkeylen);
 		if (out != NULL)
 			BIO_free_all(out);
 		if (btmp != NULL)
-- 
cgit v1.2.3-55-g6feb