This memset() in the ubsec ENGINE is a bug. Zeroing out the result array

should not be necessary in any case, but more importantly the result and
input BIGNUMs could be the same, in which case this is clearly a problem.

Submitted by: Jonathan Hersch
Reviewed by: Joe Orton
Approved by: Geoff Thorpe

diff --git a/engines/e_ubsec.c b/engines/e_ubsec.c
index 02927d7b387c733a0d885e2086f4b25be6b6060f..b019714a566e55aebbe8d9287b2253a221ce1a92 100644 (file)
--- a/engines/e_ubsec.c
+++ b/engines/e_ubsec.c
@@ -566,7 +566,6 @@ static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_BN_EXPAND_FAIL);
                return 0;
        }
-       memset(r->d, 0, BN_num_bytes(m));
 
        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
                fd = 0;