e_aes_cbc_hmac_sha1.c: cleanse temporary copy of HMAC secret.

(cherry picked from commit 529d27ea472fc2c7ba9190a15a58cb84012d4ec6)

diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c
index 310ecf58d6f79eadee83bd4a093cab97c4aa4a61..4650ea0d64d03f4df3ee2b010c3bb3b9605aff6b 100644 (file)
--- a/crypto/evp/e_aes_cbc_hmac_sha1.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha1.c
@@ -473,6 +473,8 @@ static int aesni_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void
                SHA1_Init(&key->tail);
                SHA1_Update(&key->tail,hmac_key,sizeof(hmac_key));
 
+               OPENSSL_cleanse(hmac_key,sizeof(hmac_key));
+
                return 1;
                }
        case EVP_CTRL_AEAD_TLS1_AAD: