fix: zeroize EC private-key DER before free - #269
Merged
aidankeefe2022 merged 1 commit intoOct 1, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR fixes a sensitive-data handling bug in wolfCLU_ecparam by zeroizing a DER-encoded EC private-key buffer prior to freeing it, preventing private-key material from remaining in heap memory after XFREE.
Changes:
- Add a defensive
derSz > 0check before zeroizing. - Call
wolfCLU_ForceZero(der, derSz)before freeing the DER buffer in theecparam -genkey ... -outform derpath.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
MarkAtwood
force-pushed
the
fix/ecparam-forcezero-der-privkey
branch
from
September 24, 2026 22:47
a80d7c7 to
2fc8bed
Compare
MarkAtwood
marked this pull request as ready for review
September 24, 2026 23:52
aidankeefe2022
approved these changes
Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
In
wolfCLU_ecparam(src/ecparam/clu_ecparam.c), theecparam -genkey ... -outform derpath serializes the EC private key into aderbuffer viawolfSSL_i2d_ECPrivateKey, writes it out, then frees it withXFREEwithout zeroizing. The freed heap buffer holds live private-key material.Fix
ForceZero the buffer before
XFREE, matching wolfCLU's own established convention for DER private-key buffers (src/pkey/clu_pkey.c:340,src/pkey/clu_rsa.c:273,src/ocsp/clu_ocsp.c:893). The ecparam genkey DER path was the sole outlier. ThederSz > 0guard is defensive sincewolfCLU_ForceZero(void*, unsigned int)casts the length.How verified
Built against a full
--enable-allwolfSSL install:make -j8recompilesclu_ecparam.oand relinks thewolfsslbinary, exit 0. Runtime repro confirmed the pre-fix buffer held a valid 256-bit EC private key (decoded independently with OpenSSL).Reported by static analysis (Fenrir finding 667, missing_forcezero).
[fenrir-sweep:held]