From 895454da016ffde7310080e51321ac982c4b76ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 4 Oct 2019 10:23:31 +0200 Subject: [PATCH] Use plain memset() for public data in ssl_tls.c - out_ctr is public because it's transmited over the wire in DTLS (and in TLS it can be inferred by a passive network attacker just by counting records). - handshake mask is not a secret because it can be inferred by a passive network attacker just logging record sequence number seen so far. --- library/ssl_tls.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index e9102a761..46ef06bb3 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -4712,7 +4712,7 @@ static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len ) mask[last_byte_idx] |= 1 << ( 8 - end_bits ); } - mbedtls_platform_memset( mask + offset / 8, 0xFF, len / 8 ); + memset( mask + offset / 8, 0xFF, len / 8 ); } /* @@ -7799,7 +7799,7 @@ int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl ) memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 ); /* Set sequence_number to zero */ - mbedtls_platform_memset( ssl->cur_out_ctr + 2, 0, 6 ); + memset( ssl->cur_out_ctr + 2, 0, 6 ); /* Increment epoch */ for( i = 2; i > 0; i-- ) @@ -8379,7 +8379,7 @@ static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial ) ssl->split_done = 0; #endif - mbedtls_platform_memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) ); + memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) ); ssl->transform_in = NULL; ssl->transform_out = NULL;