zero sensitive data more secure way

diff --git a/ext/standard/crypt_sha512.c b/ext/standard/crypt_sha512.c
index 0f696f5cd352119ad920b1ce4bf169ef052b91f1..0b6c338d6123dd367157ecc188159892d4d959f3 100644 (file)
--- a/ext/standard/crypt_sha512.c
+++ b/ext/standard/crypt_sha512.c
@@ -619,6 +619,19 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen)
         inside the SHA512 implementation as well.  */
        sha512_init_ctx(&ctx);
        sha512_finish_ctx(&ctx, alt_result);
+#ifdef PHP_WIN32
+       RtlSecureZeroMemory(temp_result, sizeof(temp_result));
+       RtlSecureZeroMemory(p_bytes, key_len);
+       RtlSecureZeroMemory(s_bytes, salt_len);
+       RtlSecureZeroMemory(&ctx, sizeof(ctx));
+       RtlSecureZeroMemory(&alt_ctx, sizeof(alt_ctx));
+       if (copied_key != NULL) {
+               RtlSecureZeroMemory(copied_key, key_len);
+       }
+       if (copied_salt != NULL) {
+               RtlSecureZeroMemory(copied_salt, salt_len);
+       }
+#else
        memset(temp_result, '\0', sizeof(temp_result));
        memset(p_bytes, '\0', key_len);
        memset(s_bytes, '\0', salt_len);
@@ -630,6 +643,7 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen)
        if (copied_salt != NULL) {
                memset(copied_salt, '\0', salt_len);
        }
+#endif
 
        return buffer;
 }