quickjs-tart

commit 7ce0918e8e9867f7c8746c5d8147cda154312f32
parent e744b035e05fc9e66dc659ddb3f52d3c7dcb0289
Author: Florian Dold <florian@dold.me>
Date:   Mon, 17 Mar 2025 12:52:52 +0100

clean up private key on stack

Diffstat:
M
tart_module.c
 | 
26
+++++++++++++++++++-------

1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/tart_module.c b/tart_module.c
@@ -534,6 +534,7 @@ static JSValue js_talercrypto_hash_argon2id(JSContext *ctx, JSValue this_val,
 static JSValue js_talercrypto_eddsa_key_get_public(JSContext *ctx, JSValue this_val,
                                                    int argc, JSValueConst *argv)
 {
+    JSValue ret;
     uint8_t *buf;
     unsigned char pk[crypto_sign_PUBLICKEYBYTES];
     unsigned char sk[crypto_sign_SECRETKEYBYTES];
@@ -541,33 +542,44 @@ static JSValue js_talercrypto_eddsa_key_get_public(JSContext *ctx, JSValue this_
     buf = expect_fixed_buffer(ctx, argv[0], 32, "eddsa private key");
     
     if (!buf) {
-        return JS_EXCEPTION;
+        goto exception;
     }
 
     crypto_sign_seed_keypair(pk, sk, buf);
-    // FIXME: clean up stack!
 
-    return make_js_ta_copy(ctx, pk, crypto_sign_PUBLICKEYBYTES);
+    ret = make_js_ta_copy(ctx, pk, crypto_sign_PUBLICKEYBYTES);
+done:
+    sodium_memzero(sk, sizeof sk);
+    return ret;
+exception:
+    ret = JS_EXCEPTION;
+    goto done;
 }
 
 static JSValue js_talercrypto_ecdhe_key_get_public(JSContext *ctx, JSValue this_val,
                                                    int argc, JSValueConst *argv)
 {
+    JSValue ret;
     uint8_t *buf;
     unsigned char pk[crypto_scalarmult_BYTES];
 
     buf = expect_fixed_buffer(ctx, argv[0], 32, "ecdh private key");
     
     if (!buf) {
-        return JS_EXCEPTION;
+        goto exception;
     }
 
     if (0 != crypto_scalarmult_base(pk, buf)) {
-        return JS_EXCEPTION;
+        goto exception;
     }
-    // FIXME: clean up stack!
 
-    return make_js_ta_copy(ctx, pk, crypto_sign_PUBLICKEYBYTES);
+    ret = make_js_ta_copy(ctx, pk, crypto_sign_PUBLICKEYBYTES);
+done:
+    buf = NULL;
+    return ret;
+exception:
+    ret = JS_EXCEPTION;
+    goto done;
 }
 
 /**