From: Anatol Belski <ab@php.net>
Date: Thu, 18 Sep 2014 20:13:30 +0000 (+0200)
Subject: zero sensitive data more secure way
X-Git-Tag: POST_NATIVE_TLS_MERGE^2~209
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bb89ac8408d6139feef9aa318b69e4ac5ee31106;p=php

zero sensitive data more secure way
---

diff --git a/ext/standard/crypt_sha512.c b/ext/standard/crypt_sha512.c
index 0f696f5cd3..0b6c338d61 100644
--- a/ext/standard/crypt_sha512.c
+++ b/ext/standard/crypt_sha512.c
@@ -619,6 +619,19 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen)
 	 inside the SHA512 implementation as well.  */
 	sha512_init_ctx(&ctx);
 	sha512_finish_ctx(&ctx, alt_result);
+#ifdef PHP_WIN32
+	RtlSecureZeroMemory(temp_result, sizeof(temp_result));
+	RtlSecureZeroMemory(p_bytes, key_len);
+	RtlSecureZeroMemory(s_bytes, salt_len);
+	RtlSecureZeroMemory(&ctx, sizeof(ctx));
+	RtlSecureZeroMemory(&alt_ctx, sizeof(alt_ctx));
+	if (copied_key != NULL) {
+		RtlSecureZeroMemory(copied_key, key_len);
+	}
+	if (copied_salt != NULL) {
+		RtlSecureZeroMemory(copied_salt, salt_len);
+	}
+#else
 	memset(temp_result, '\0', sizeof(temp_result));
 	memset(p_bytes, '\0', key_len);
 	memset(s_bytes, '\0', salt_len);
@@ -630,6 +643,7 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen)
 	if (copied_salt != NULL) {
 		memset(copied_salt, '\0', salt_len);
 	}
+#endif
 
 	return buffer;
 }