WolfSSL
/
wolfcrypt-jni
mirror of https://github.com/wolfSSL/wolfcrypt-jni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-4370: zeroize native PKCS8 key copy in X509CheckPrivateKey

pull/262/head
Chris Conlon 2026-08-19 12:52:05 -06:00
parent c4f94d1314
commit 97e1229fa0
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
jni/jni_jce_wolfsslkeystore.c
View File

@ -25,7 +25,9 @@
#include <wolfssl/options.h>
#endif
#include <wolfssl/version.h>
#include <wolfssl/ssl.h>
#include <wolfssl/wolfcrypt/memory.h>
#include <com_wolfssl_provider_jce_WolfSSLKeyStore.h>
#include <wolfcrypt_jni_error.h>
@ -40,6 +42,7 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_provider_jce_WolfSSLKeyStore_X509Che
int ret = WOLFSSL_SUCCESS;
int certDerSz = 0;
int keyDerSz = 0;
jboolean keyDerIsCopy = JNI_FALSE;
byte* certDer = NULL;
byte* keyDer = NULL;
byte* pkcs8KeyDer = NULL;
@ -57,7 +60,8 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_provider_jce_WolfSSLKeyStore_X509Che
certDer = (byte*)(*env)->GetByteArrayElements(env, certDerArr, NULL);
certDerSz = (*env)->GetArrayLength(env, certDerArr);
keyDer = (byte*)(*env)->GetByteArrayElements(env, pkcs8KeyDerArr, NULL);
keyDer = (byte*)(*env)->GetByteArrayElements(env, pkcs8KeyDerArr,
&keyDerIsCopy);
keyDerSz = (*env)->GetArrayLength(env, pkcs8KeyDerArr);
/* Keep original keyDer pointer for free later, wolfSSL_d2i_PKCS8_PKEY
* will change/advance the pointer. */
@ -118,8 +122,16 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_provider_jce_WolfSSLKeyStore_X509Che
(jbyte*)certDer, JNI_ABORT);
}
if (keyDer != NULL) {
if (keyDerIsCopy == JNI_TRUE) {
#if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
!defined(WOLFSSL_NO_FORCE_ZERO)
wc_ForceZero(keyDer, keyDerSz);
#else
XMEMSET(keyDer, 0, keyDerSz);
#endif
}
(*env)->ReleaseByteArrayElements(env, pkcs8KeyDerArr,
(jbyte*)keyDer, JNI_ABORT);
(jbyte*)keyDer, JNI_ABORT);
}
if (ret == WOLFSSL_SUCCESS) {