memwash might not behave as intended

Fedict / eid-mw

eID Middleware (main repository)

GNU Lesser General Public License v3.0

202 stars 79 forks source link

memwash might not behave as intended #144

Closed ViralTaco closed 3 years ago

ViralTaco commented 3 years ago

https://github.com/Fedict/eid-mw/blob/2b8d9b1ee211d49011838d662cf899fe4dc3b9ba/cardcomm/pkcs11/src/pkcs11util.cpp#L53-L59

Expected Behavior:

Set len bytes to 0, starting at p_in.

Actual Behavior:

AS-IF setting the bytes to 0.

Proposed Fix:

Don't let the compiler optimize the code, i.e.: this untested code Or the way libsodium does it It's similar but they seem to use a uchar volatile *volatile… I've never made a pointer volatile on purpose, so I don't know what that does.

ViralTaco commented 3 years ago

Right… So I looked into it and I can't find any place where it's actually used. So it might be a good idea to just either get rid of it or add a [[depricated]] attribute