Not properly clearing memory on key generation
Secure chat and conferencing protocol
Brought to you by:
priikone
From: Michael L. <you...@sn...> - 2002-05-28 23:41:23
|
Looking through the silc code, I happened upon this in irssi/src/silc/core/clientutil.c: memset(key, 0, sizeof(key_len)); This seems wrong. key_len is just an int containing the length of key. Simple patch: --- clientutil.c Thu Apr 11 10:40:26 2002 +++ clientutil.c- Tue May 28 18:40:09 2002 @@ -223,7 +223,7 @@ if (ret_pub_key) *ret_pub_key = pub_key; - memset(key, 0, sizeof(key_len)); + memset(key, 0, key_len); silc_free(key); /* Save private key into file */ @@ -239,7 +239,7 @@ printf("Press <Enter> to continue...\n"); getchar(); - memset(key, 0, sizeof(key_len)); + memset(key, 0, key_len); silc_free(key); silc_rng_free(rng); |