secure erase the key_desc in case it's a pkcs11 uri with pin

embetrix · Dec 19, 2024 · bd0367f · bd0367f
1 parent 3c90bf8
commit bd0367f
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/stm32mp-sign-tool.cpp b/stm32mp-sign-tool.cpp
@@ -564,5 +564,10 @@ int main(int argc, char* argv[]) {
         std::memset(static_cast<void*>(const_cast<char*>(passphrase)), 0, std::strlen(passphrase));
     }
 
+    // Securely erase the key_desc in case it's a pkcs11 uri with pin
+    if (key_desc) {
+        std::memset(static_cast<void*>(const_cast<char*>(key_desc)), 0, std::strlen(key_desc));
+    }
+
     return 0;
 }