openssl / openssl

TLS/SSL and crypto library

Home Page:https://www.openssl.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

OPENSSL_clear_free instead of OPENSSL_free

ManSoSec opened this issue · comments

It seems OPENSSL_clear_free needs to be called instead of OPENSSL_free here:

OPENSSL_free(der);

As it has done here:

OPENSSL_clear_free(der, derlen);

In the verify path nothing is secret, so actually we should use free instead of clear_free also in the ecdsa part!

Yes - agreed. OPENSSL_free is sufficient. Still a bug - but in ecdsa_ossl.c not sm2_sign.c