Skip to content

Commit 5658254

Browse files
wangweijwangweij
committed
8258915: More temporary buffer cleanup
8258915: More temporary buffer cleanup
1 parent ccdf171 commit 5658254

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1141
-838
lines changed

‎src/java.base/share/classes/com/sun/crypto/provider/AESCipher.java‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2002, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -40,6 +40,7 @@
4040
import java.security.ProviderException;
4141
import java.security.SecureRandom;
4242
import java.security.spec.AlgorithmParameterSpec;
43+
import java.util.Arrays;
4344

4445
/**
4546
* This class implements the AES algorithm in its various modes
@@ -163,9 +164,12 @@ static final void checkKeySize(Key key, int fixedKeySize)
163164
byte[] value = key.getEncoded();
164165
if (value == null) {
165166
throw new InvalidKeyException("Key encoding must not be null");
166-
} else if (value.length != fixedKeySize) {
167-
throw new InvalidKeyException("The key must be " +
168-
fixedKeySize + " bytes");
167+
} else {
168+
Arrays.fill(value, (byte)0);
169+
if (value.length != fixedKeySize) {
170+
throw new InvalidKeyException("The key must be " +
171+
fixedKeySize + " bytes");
172+
}
169173
}
170174
}
171175
}
@@ -515,6 +519,7 @@ protected int engineDoFinal(byte[] input, int inputOffset, int inputLen,
515519
*/
516520
protected int engineGetKeySize(Key key) throws InvalidKeyException {
517521
byte[] encoded = key.getEncoded();
522+
Arrays.fill(encoded, (byte)0);
518523
if (!AESCrypt.isKeySizeValid(encoded.length)) {
519524
throw new InvalidKeyException("Invalid AES key length: " +
520525
encoded.length + " bytes");

‎src/java.base/share/classes/com/sun/crypto/provider/AESCrypt.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2002, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -94,6 +94,9 @@ void init(boolean decrypting, String algorithm, byte[] key)
9494
if (!MessageDigest.isEqual(key, lastKey)) {
9595
// re-generate session key 'sessionK' when cipher key changes
9696
makeSessionKey(key);
97+
if (lastKey != null) {
98+
Arrays.fill(lastKey, (byte)0);
99+
}
97100
lastKey = key.clone(); // save cipher key
98101
}
99102

‎src/java.base/share/classes/com/sun/crypto/provider/AESWrapCipher.java‎

Lines changed: 71 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2004, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2004, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -198,7 +198,12 @@ protected void engineInit(int opmode, Key key, SecureRandom random)
198198
"only be used for key wrapping and unwrapping");
199199
}
200200
AESCipher.checkKeySize(key, fixedKeySize);
201-
cipher.init(decrypting, key.getAlgorithm(), key.getEncoded());
201+
byte[] encoded = key.getEncoded();
202+
try {
203+
cipher.init(decrypting, key.getAlgorithm(), encoded);
204+
} finally {
205+
Arrays.fill(encoded, (byte)0);
206+
}
202207
}
203208

204209
/**
@@ -374,6 +379,7 @@ protected AlgorithmParameters engineGetParameters() {
374379
*/
375380
protected int engineGetKeySize(Key key) throws InvalidKeyException {
376381
byte[] encoded = key.getEncoded();
382+
Arrays.fill(encoded, (byte)0);
377383
if (!AESCrypt.isKeySizeValid(encoded.length)) {
378384
throw new InvalidKeyException("Invalid key length: " +
379385
encoded.length + " bytes");
@@ -404,38 +410,42 @@ protected byte[] engineWrap(Key key)
404410
throw new InvalidKeyException("Cannot get an encoding of " +
405411
"the key to be wrapped");
406412
}
407-
byte[] out = new byte[Math.addExact(keyVal.length, 8)];
413+
try {
414+
byte[] out = new byte[Math.addExact(keyVal.length, 8)];
408415

409-
if (keyVal.length == 8) {
410-
System.arraycopy(IV, 0, out, 0, IV.length);
411-
System.arraycopy(keyVal, 0, out, IV.length, 8);
412-
cipher.encryptBlock(out, 0, out, 0);
413-
} else {
414-
if (keyVal.length % 8 != 0) {
415-
throw new IllegalBlockSizeException("length of the " +
416-
"to be wrapped key should be multiples of 8 bytes");
417-
}
418-
System.arraycopy(IV, 0, out, 0, IV.length);
419-
System.arraycopy(keyVal, 0, out, IV.length, keyVal.length);
420-
int N = keyVal.length/8;
421-
byte[] buffer = new byte[blksize];
422-
for (int j = 0; j < 6; j++) {
423-
for (int i = 1; i <= N; i++) {
424-
int T = i + j*N;
425-
System.arraycopy(out, 0, buffer, 0, IV.length);
426-
System.arraycopy(out, i*8, buffer, IV.length, 8);
427-
cipher.encryptBlock(buffer, 0, buffer, 0);
428-
for (int k = 1; T != 0; k++) {
429-
byte v = (byte) T;
430-
buffer[IV.length - k] ^= v;
431-
T >>>= 8;
416+
if (keyVal.length == 8) {
417+
System.arraycopy(IV, 0, out, 0, IV.length);
418+
System.arraycopy(keyVal, 0, out, IV.length, 8);
419+
cipher.encryptBlock(out, 0, out, 0);
420+
} else {
421+
if (keyVal.length % 8 != 0) {
422+
throw new IllegalBlockSizeException("length of the " +
423+
"to be wrapped key should be multiples of 8 bytes");
424+
}
425+
System.arraycopy(IV, 0, out, 0, IV.length);
426+
System.arraycopy(keyVal, 0, out, IV.length, keyVal.length);
427+
int N = keyVal.length / 8;
428+
byte[] buffer = new byte[blksize];
429+
for (int j = 0; j < 6; j++) {
430+
for (int i = 1; i <= N; i++) {
431+
int T = i + j * N;
432+
System.arraycopy(out, 0, buffer, 0, IV.length);
433+
System.arraycopy(out, i * 8, buffer, IV.length, 8);
434+
cipher.encryptBlock(buffer, 0, buffer, 0);
435+
for (int k = 1; T != 0; k++) {
436+
byte v = (byte) T;
437+
buffer[IV.length - k] ^= v;
438+
T >>>= 8;
439+
}
440+
System.arraycopy(buffer, 0, out, 0, IV.length);
441+
System.arraycopy(buffer, 8, out, 8 * i, 8);
432442
}
433-
System.arraycopy(buffer, 0, out, 0, IV.length);
434-
System.arraycopy(buffer, 8, out, 8*i, 8);
435443
}
436444
}
445+
return out;
446+
} finally {
447+
Arrays.fill(keyVal, (byte)0);
437448
}
438-
return out;
439449
}
440450

441451
/**
@@ -474,38 +484,43 @@ protected Key engineUnwrap(byte[] wrappedKey,
474484
}
475485
byte[] out = new byte[wrappedKeyLen - 8];
476486
byte[] buffer = new byte[blksize];
477-
if (wrappedKeyLen == 16) {
478-
cipher.decryptBlock(wrappedKey, 0, buffer, 0);
479-
for (int i = 0; i < IV.length; i++) {
480-
if (IV[i] != buffer[i]) {
481-
throw new InvalidKeyException("Integrity check failed");
487+
try {
488+
if (wrappedKeyLen == 16) {
489+
cipher.decryptBlock(wrappedKey, 0, buffer, 0);
490+
for (int i = 0; i < IV.length; i++) {
491+
if (IV[i] != buffer[i]) {
492+
throw new InvalidKeyException("Integrity check failed");
493+
}
482494
}
483-
}
484-
System.arraycopy(buffer, IV.length, out, 0, out.length);
485-
} else {
486-
System.arraycopy(wrappedKey, 0, buffer, 0, IV.length);
487-
System.arraycopy(wrappedKey, IV.length, out, 0, out.length);
488-
int N = out.length/8;
489-
for (int j = 5; j >= 0; j--) {
490-
for (int i = N; i > 0; i--) {
491-
int T = i + j*N;
492-
System.arraycopy(out, 8*(i-1), buffer, IV.length, 8);
493-
for (int k = 1; T != 0; k++) {
494-
byte v = (byte) T;
495-
buffer[IV.length - k] ^= v;
496-
T >>>= 8;
495+
System.arraycopy(buffer, IV.length, out, 0, out.length);
496+
} else {
497+
System.arraycopy(wrappedKey, 0, buffer, 0, IV.length);
498+
System.arraycopy(wrappedKey, IV.length, out, 0, out.length);
499+
int N = out.length / 8;
500+
for (int j = 5; j >= 0; j--) {
501+
for (int i = N; i > 0; i--) {
502+
int T = i + j * N;
503+
System.arraycopy(out, 8 * (i - 1), buffer, IV.length, 8);
504+
for (int k = 1; T != 0; k++) {
505+
byte v = (byte) T;
506+
buffer[IV.length - k] ^= v;
507+
T >>>= 8;
508+
}
509+
cipher.decryptBlock(buffer, 0, buffer, 0);
510+
System.arraycopy(buffer, IV.length, out, 8 * (i - 1), 8);
497511
}
498-
cipher.decryptBlock(buffer, 0, buffer, 0);
499-
System.arraycopy(buffer, IV.length, out, 8*(i-1), 8);
500512
}
501-
}
502-
for (int i = 0; i < IV.length; i++) {
503-
if (IV[i] != buffer[i]) {
504-
throw new InvalidKeyException("Integrity check failed");
513+
for (int i = 0; i < IV.length; i++) {
514+
if (IV[i] != buffer[i]) {
515+
throw new InvalidKeyException("Integrity check failed");
516+
}
505517
}
506518
}
519+
return ConstructKeys.constructKey(out, wrappedKeyAlgorithm,
520+
wrappedKeyType);
521+
} finally {
522+
Arrays.fill(out, (byte)0);
523+
Arrays.fill(buffer, (byte)0);
507524
}
508-
return ConstructKeys.constructKey(out, wrappedKeyAlgorithm,
509-
wrappedKeyType);
510525
}
511526
}

‎src/java.base/share/classes/com/sun/crypto/provider/ARCFOURCipher.java‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2003, 2017, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -27,6 +27,7 @@
2727

2828
import java.security.*;
2929
import java.security.spec.AlgorithmParameterSpec;
30+
import java.util.Arrays;
3031

3132
import javax.crypto.*;
3233

@@ -180,6 +181,9 @@ protected void engineInit(int opmode, Key key,
180181

181182
// init method. Check opmode and key, then call init(byte[]).
182183
private void init(int opmode, Key key) throws InvalidKeyException {
184+
if (lastKey != null) {
185+
Arrays.fill(lastKey, (byte)0);
186+
}
183187
if ((opmode < Cipher.ENCRYPT_MODE) || (opmode > Cipher.UNWRAP_MODE)) {
184188
throw new InvalidKeyException("Unknown opmode: " + opmode);
185189
}
@@ -199,6 +203,7 @@ private static byte[] getEncodedKey(Key key) throws InvalidKeyException {
199203
}
200204
byte[] encodedKey = key.getEncoded();
201205
if ((encodedKey.length < 5) || (encodedKey.length > 128)) {
206+
Arrays.fill(encodedKey, (byte)0);
202207
throw new InvalidKeyException
203208
("Key length must be between 40 and 1024 bit");
204209
}
@@ -244,19 +249,31 @@ protected byte[] engineWrap(Key key) throws IllegalBlockSizeException,
244249
if ((encoded == null) || (encoded.length == 0)) {
245250
throw new InvalidKeyException("Could not obtain encoded key");
246251
}
247-
return engineDoFinal(encoded, 0, encoded.length);
252+
try {
253+
return engineDoFinal(encoded, 0, encoded.length);
254+
} finally {
255+
Arrays.fill(encoded, (byte)0);
256+
}
248257
}
249258

250259
// see JCE spec
251260
protected Key engineUnwrap(byte[] wrappedKey, String algorithm,
252261
int type) throws InvalidKeyException, NoSuchAlgorithmException {
253-
byte[] encoded = engineDoFinal(wrappedKey, 0, wrappedKey.length);
254-
return ConstructKeys.constructKey(encoded, algorithm, type);
262+
byte[] encoded = null;
263+
try {
264+
encoded = engineDoFinal(wrappedKey, 0, wrappedKey.length);
265+
return ConstructKeys.constructKey(encoded, algorithm, type);
266+
} finally {
267+
if (encoded != null) {
268+
Arrays.fill(encoded, (byte) 0);
269+
}
270+
}
255271
}
256272

257273
// see JCE spec
258274
protected int engineGetKeySize(Key key) throws InvalidKeyException {
259275
byte[] encodedKey = getEncodedKey(key);
276+
Arrays.fill(encodedKey, (byte)0);
260277
return Math.multiplyExact(encodedKey.length, 8);
261278
}
262279

‎src/java.base/share/classes/com/sun/crypto/provider/BlowfishCipher.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1998, 2017, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1998, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -27,6 +27,8 @@
2727

2828
import java.security.*;
2929
import java.security.spec.*;
30+
import java.util.Arrays;
31+
3032
import sun.security.util.*;
3133
import javax.crypto.*;
3234
import javax.crypto.spec.*;
@@ -373,7 +375,9 @@ protected int engineDoFinal(byte[] input, int inputOffset, int inputLen,
373375
* @exception InvalidKeyException if <code>key</code> is invalid.
374376
*/
375377
protected int engineGetKeySize(Key key) throws InvalidKeyException {
376-
return Math.multiplyExact(key.getEncoded().length, 8);
378+
byte[] encodedKey = key.getEncoded();
379+
Arrays.fill(encodedKey, (byte)0);
380+
return Math.multiplyExact(encodedKey.length, 8);
377381
}
378382

379383
/**

‎src/java.base/share/classes/com/sun/crypto/provider/ChaCha20Cipher.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -33,6 +33,7 @@
3333
import java.nio.ByteOrder;
3434
import java.security.*;
3535
import java.security.spec.AlgorithmParameterSpec;
36+
import java.util.Arrays;
3637
import java.util.Objects;
3738
import javax.crypto.*;
3839
import javax.crypto.spec.ChaCha20ParameterSpec;
@@ -546,6 +547,9 @@ private void init(int opmode, Key key, byte[] newNonce)
546547
// assigning them to the object.
547548
byte[] newKeyBytes = getEncodedKey(key);
548549
checkKeyAndNonce(newKeyBytes, newNonce);
550+
if (this.keyBytes != null) {
551+
Arrays.fill(this.keyBytes, (byte)0);
552+
}
549553
this.keyBytes = newKeyBytes;
550554
nonce = newNonce;
551555

@@ -612,6 +616,9 @@ private static byte[] getEncodedKey(Key key) throws InvalidKeyException {
612616
}
613617
byte[] encodedKey = key.getEncoded();
614618
if (encodedKey == null || encodedKey.length != 32) {
619+
if (encodedKey != null) {
620+
Arrays.fill(encodedKey, (byte)0);
621+
}
615622
throw new InvalidKeyException("Key length must be 256 bits");
616623
}
617624
return encodedKey;
@@ -790,6 +797,7 @@ protected Key engineUnwrap(byte[] wrappedKey, String algorithm,
790797
@Override
791798
protected int engineGetKeySize(Key key) throws InvalidKeyException {
792799
byte[] encodedKey = getEncodedKey(key);
800+
Arrays.fill(encodedKey, (byte)0);
793801
return encodedKey.length << 3;
794802
}
795803

0 commit comments

Comments
 (0)