cipher-kdf.c: balloon_close: missing factor in wipememory() call

--b1=_v1Dm0eFLfJQ94gqxbHKdIjrELSzBaw9Wm75gUl4UkY
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi all,

Okay, next issue, this one should be straightforward (one-liner):

A forgotten (... * b->blklen) factor in balloon_close causes=20
wipememory() to wipe only a tiny fraction of the balloon working memory=20
before freeing it.

--- - wipememory (b->block, parallelism * b->n_blocks); + wipememory=20
(b->block, parallelism * b->n_blocks * b->blklen); ---

The allocation is in: balloon_open (line 1145):

block =3D xtrycalloc (parallelism * b->n_blocks, b->blklen);

This block contains intermediate hash values of the key material, but=20
it's a wipe after the algo has run, so it's not critical, probably.

Thanks for your time, --Bert


--b1=_v1Dm0eFLfJQ94gqxbHKdIjrELSzBaw9Wm75gUl4UkY
Content-Type: text/x-patch; charset=UTF-8; name=balloon-close-wipememory.patch
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=balloon-close-wipememory.patch

ZGlmZiAtLWdpdCBhL2NpcGhlci9rZGYuYyBiL2NpcGhlci9rZGYuYwppbmRleCAxNmNlYzRlNC4u
NjZlZmY2YzYgMTAwNjQ0Ci0tLSBhL2NpcGhlci9rZGYuYworKysgYi9jaXBoZXIva2RmLmMKQEAg
LTE0MTYsNyArMTQxNiw3IEBAIGJhbGxvb25fY2xvc2UgKGJhbGxvb25fY3R4X3QgYikKIAogICBp
ZiAoYi0+YmxvY2spCiAgICAgewotICAgICAgd2lwZW1lbW9yeSAoYi0+YmxvY2ssIHBhcmFsbGVs
aXNtICogYi0+bl9ibG9ja3MpOworICAgICAgd2lwZW1lbW9yeSAoYi0+YmxvY2ssIHBhcmFsbGVs
aXNtICogYi0+bl9ibG9ja3MgKiBiLT5ibGtsZW4pOwogICAgICAgeGZyZWUgKGItPmJsb2NrKTsK
ICAgICB9CiAK

--b1=_v1Dm0eFLfJQ94gqxbHKdIjrELSzBaw9Wm75gUl4UkY
Content-Type: application/pgp-keys; name=OpenPGP_0x1B93BFCB9DEDFAA0.asc
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=OpenPGP_0x1B93BFCB9DEDFAA0.asc

LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tDQoNCnhzRk5CR1lTZk1rQkVBQzVE
UDdSVk5McWovWDlQYjB3dEpNcWxidGFpRG1QcUpZZms5TTFVMnJHWGJiZ21ZV2INCmRXR3NTbldM
UktmVDU4OVNuQ3YwaklVejFBMHNYZTYyUlhTdG5GRm0yOWFPOVdDL3BXSmEzbXpTYlFEaU55QU8N
CmxhV0MrYlNyczZjNUtqak55bjhWa040MUVaTVp1ZUFpcitIcVVuYTNiWVVieWQrVE9ackMxenk2
VDZBUEpwZXUNCnAxaE5TblQwQ3VjRjZBNXEwczk2VTBNZ2hYMjM2ZlBURTY3YUZuWmpXVFcrVXh0
b2F0Rmlwb0pmZFJ4TWtWTjINCnJzRWM4c1BBa016OVVTSGJYL2tOZGdVZzhPbVJ2QnE0ZUN6Njcz
endhV3U1Z3pLck54U0VGQjNkQWkybUkxUXcNCi9ObUhOdzN6enNMd21EVFdGMmxiZDJCQVRKRzMy
bmV1SlNpdFRQTVVzUVVpMXNFYkFjZXFnd3VNRjBmZVlKa2wNCnhQYmNJWEJDbEhTVXFiKytWbUhk
WlhQS1Q4dXBzTUlrTXk1TjBGZUZFVTN2MHFxMSt4cHd5clRuMTQ2RDlNWUsNClF5aFJYYllnWlg4
bFJDU2RaL3BRaU52WnJRR0lMOWx2VG9RNWV3Y3l6UjNHYzI4Ny9sWGk4ZGlwNXNPZ1FNWlQNCm5z
ZEZJT01vUjRUaklNWVB6VExSVHVySVVoTzV5Z1dFRkdFZjkwbjJSVUs5TEJXTmlpRzYvZmwyWXg1
NWptUk4NCkVNczdId3VrNGo2K1lFaTBSWUtRT0F2bWF5MDYva04rY3NocHZmdVZNNzJTWlJNQm1t
Q0Z4MmFjajk3TzdFd08NCkhVL1FnRWgrODQ5ZGpaOGJCNEN6UHlXaGtmOG9oT0VUK2ZhWS9zeUdn
MU9hNmdEVk1tSHFNYzdiK1FBUkFRQUINCnpTZENaWEowSUhaaGJpQmtaWElnVjJWbGNtUWdQR0ps
Y25SQWRHVmhiWE53YVdONUxtNWxkRDdDd1pFRUV3RUkNCkFEc1dJUVFSeW1EQ1RrZjhUYWxIdVhz
Yms3L0xuZTM2b0FVQ1poSjh5UUliQXdVTENRZ0hBZ0lpQWdZVkNna0kNCkN3SUVGZ0lEQVFJZUJ3
SVhnQUFLQ1JBYms3L0xuZTM2b0dRdkVBQ1VWODB2em92RFdyaHJsZ1JFZEtRNE9PNzYNCjA2djhF
VXQydUZsT3FZZldQd2UzUUxia3pEODVPclpjKzJtQmdTdVR5aEdhSWJOaEsxTk1idzk5TVRlbmhz
ejINClE1Tm9uUSt5UHNWSkJZVG5KRGxSczVicmNPRkpRTFpERCtJN0g1TnhER05nVW9DSm93TG9p
Q3gzdlVXYXRqVFoNCndKckdJd2FQUUNleC92d3dPdHR4eDRnUzlSTGNjTzMyaFFLdlZwbTVzNm5G
em9SWHZZWEEwOWZQa2xtRFV6ckgNCllEdXhhM0ZmdVdvMW1rOFpWWTVMbzQvR0paSXkzRzBrUVRU
RXNPSjBuU1lzZGdzNTk1aVM4MG0xOUlsOHNHcTYNCjdNNGxNN3BKellQL0NxRGVjbjg1dW5rSytH
ZjUxSCtFZWlSZnZpWXd5enRFRjhqNE9nODYvbzFlaUQ5MUFOTEQNCjYrOTkzTVhZRGVkdy85ZlFX
OGVSNjBnRXByWlcrV0FCSTRhTFRXQnZkK0VaVVhGdWdkVmhsWWhRL3ZidWVtczENCjY5enAvM1ZH
YjljUExHWjR0Qm5pUk9IaGV3WTZSTFZuNi9tc3gyMkpnb3BVSlIrVGFmeFBMeFlYL3BKdkwzb2YN
ClZNdlc4RXlQT2FyaGc3VGdaMWNvc3ZVRUw3NFdqQ2h0cjAyZlBscVdQRFRTU1hKOVJBTGhqRlBu
L1JINS9FYzcNClp1Njl4NUZ5TTVGa0M1WjdjVzRqbXBaeWkzbnBSbVUweFVmM2lwV3FHNHhTQ05v
ejJYR0ZOVHc0TStDRmlTZU8NCisvZ0pwcXJpVklRS2ZyMzVNN1hHbG1TQlF6eWlCL0tPSjYrSlN4
Z1ZJOWcwN2dJdjRaTXFnTWQveXQ0N1I0NWQNCm4xenc4R0xndm92ZVhQQmZTYzdCVFFSbUVuekpB
UkFBdnEwNnB5SGc2ajllUjZZUEZqU3lUdGZlV09ZQll5dDENCkswLzYzMU5mVEU4QkgxY1FpQi9U
cTBTRkp6OXZsclZtTTdkOVJYUUtNZHBYWVVlUDY5Z0Uva1E4S2tZWldmVEwNClJCWTVOWFUxY1pq
UW1mN0JQQ0RUVW42ZjRwMlp2L2hRczNHSEpadkg4eFU5VTcxWkFWcTF6SzI2eHdZQkdVMlINCmlx
d3dBUjVRMEl2UWF5SVI4K3pzN3NwVXFzZGhUU3hBaU1lNWo0dVV3VjlMYkVDOVZOdlZjVVBvQ3hj
UVhtaHINCkJUT01FWHNUT1FDUXlyRHlIWm5qOWlxZXBob3M0NUlRQzNPUWg0ZThWdHdncGpqeHBh
MFZuWFR0VkpRUkpJZm4NCmtRL2oweXpKRTFhUVpkRDNHdEJWc1Q1aGFGRDdKR2dMRU5YTXk4MkNn
YzMrV2oxYUZTSG1QcGtEdzg0QUU4V2sNCk5nMXVMTHN0R0puS0NBN3BrbHVHbjMzc1BxYW4rUjNl
dzFDNnNDZ0JoOW1CYThiWmdxVGdzMnovRkgrODFuY2QNCmdKZFhGV0UwUUJoeEtUbEsxenowazll
dHVIV3h3M3Vya1FkOWp2dGZUVjIxenltKzZFRUNTMytkTHBDNzBJR2cNCm9YRjZ5Mk5hc2hFNit1
NWNWV0Z2WkJiN2MwVk5xL29JdXFZbHJQekpxYTUwT2M5VlJPbzJXN3VqbW9IWXhEWmQNCjh6T2Ji
YmNjTVhsU2tjeXFXMGlXNkk2aTRjZGpmWDRZb3VWenM4ajJqSExjdDFsRk5MaTRYaCt4eHJURXdq
T1UNClkwMGlvdDk3OVZ6eG84b3Zsc3J0bk55eERvUEhBQi9tbFh6d0tFUjk4aTBUWWpzR1A4bHR3
K0tRUHlaQVVTNUYNCkp6SlFjcngvUHdrQUVRRUFBY0xCZGdRWUFRZ0FJQlloQkJIS1lNSk9SL3hO
cVVlNWV4dVR2OHVkN2ZxZ0JRSm0NCkVuekpBaHNnQUFvSkVCdVR2OHVkN2ZxZzVCc1AvMmdPWjNq
N21rSlNVLzFFRm16MkFwclVoeHc4OG4yYnVXK04NCm82Y0czVUw2K2lzWndFRS9GeHhrTXJtbjFO
bTdEeTFlYVVDTS8rT053eEVPYzQ4cmlvUmxUNGxzeFo3VjZOcUoNCi93ZTZWbVhIZUJpeUZlSHVS
djFtU2o5aXhUQUJtR2VaZWtNR0tuaEp1WWVWWVFSbmpQNlQ0KzhUSzBWclpMM0QNCmRudzQ0bGV5
bEROTUMxaWdXeEhtbzQ3ZzdFc3NBSXMwMG9oNlA1d3ZYeWhHSEJUckhYM3BxUUZVd0xmdlB5TFQN
CmNZZEp0M05CdklyZGxNbStPaTZhbElSTm5DeVo1WWY2c3VFeHBUbTIyS2RXMStsOUFCaW5aaWEy
R3lXeVpRNXgNCi9ldVRqME1POGZPYnpWK09NR0dNYWNpZi9YaDR6VDJRd0dQakwwRklHYXpOZ1ZQ
Z3o3U3VpYU05QUMvNzBCbHANCk5wVDhyeHVrcEcvWjUrVmYwYmhHa01PSnhVUXBwdzJxRWlLbnpB
eFdBYTVGMVBtaTZTSTB5d0s0aXkvZkdCMkgNCjdZcEh4OXdFRzZTa2R5eTJlVzZFNFZSM3cwU2FF
TVJHVUl6ZWFHM0pleHRPYWpjOWQrYzVTQTZaMmNjRnVxOGQNClRmckYyOUc5MnU5WkpOQ2Q4aWdy
RWtiWEFjKy9sTGEzSnhyNlp3S0FjYWhXUEJYYkRHSnEzRzNXSUl1TXAxZncNCkw0RFFiYnVReDUz
TjJOUGxQS0FiNzU4RWlESnNHYzV2Z1FSR3RzZjJmYndLbUdKdnIrMkV6MUIzZk5lYWpoem0NCjJH
T3lJaFdzVjEwTXM4MVNpME1SNlgreDVqUzQ0YmF1dzZZdmFRcDFQa1loa3ZabTZlRVlvalRoeEl0
TlQySEQNClVYNlpzbWVCenNGTkJHWVNmTWtCRUFER1BwZUtqNVFYOW1pejc0bDh4NTJ5WENpa0Uv
bTcxS3lXRlZMQnNoOG8NCkRWVDlXdWs1TjdTUVpnakRnYXcveHBCbHNaeitGdUF3SGFyQnJ2MzdD
K2I3YkVVUDJUMVZVMlhQemNsdXA2SlcNCklNUVk3eEl2REwwTUJtRzRjZk9JemphV2NaTDVsTVNz
MW9sUXNsbFR0dGowM21mWkRIZ0oxRUhyWHF1YzhiMngNCnlLa1RoeW9MVGJYd3RhMEN5QVhGWjlL
endYQ0ozdU43dWpqaTViRlVxdnN6eG0vR01kUWZOMW1SL2IvZTNoSVMNCndmVHVUaXlFYm9MNis0
ZWFTamlMaHY4Vy9NVWx2b0swNGdHazc3bUFiMXBXU0hCMU1lSFB1QUYrUTdoQi8rSTANCmViMHN3
eTBsNlltNWE0Tk9KZU9scy9UcnBtNFN5SVkyd2NrVjhMczBrS3l2YjZIM0tUdXl1aG5BeGlaUS8z
YS8NCk5QR29vRS9zWm9yV2pkQURaTk5rNzlEK254cmNtVnVDbFVnUVR6ZzlpYm5vOVM1V0NQMFFO
ZEgwRElXM1dDTGINCkcxK3lhSEw1bmszVHFvUSt3VlFmUG5Ma3ZXR1pHTFVZd0pTUFNqZjh5SDlP
anpFYUhpcmFwQ3JwWllyWUU3Ty8NCnROdXRocTdJZjE4cEhldEpDUHJaaG40c0ozakgyV0lsRUJQ
QWR1RTdUNkJGNVd1S21BRlRyNE01d0w2TURpaloNCmltaTByTTh2Sk5pRldrQTBWRXJtQ2RpVzhi
Q0Fjekd4UTIyazMzMXEvN2c1dGhmSUlkNS9CaC9DYUIrMHNZY1ANCk5sN1hUWm1BZ2R0ckt3aHpX
UUJhM0RQZHVzM0tzSFZIY3cwQzNXRE9kTm82YXR1OER4ZGNMSzg1dUtCaXMyZXoNCnVRQVJBUUFC
d3NGMkJCZ0JDQUFnRmlFRUVjcGd3azVIL0UycFI3bDdHNU8veTUzdCtxQUZBbVlTZk1rQ0d3d0EN
CkNna1FHNU8veTUzdCtxQ0htZy85R2o2cnVidDcyemM1MnM4Z2JIcWNzdnFLZktNYk1DT3lSQVFW
ZHZDM1g2WDMNCmxwMy9lZmxzaStEOGFFbHJuTGw5ZmVtS2Z0RVY0T2haQUkveDVTbEkrc1hGTG96
N0pnM1NsRFE4MlYrT1RXVTcNCmVybEhma1ZoNXFXem9jRHJ2NGIremFHenFObzdPUjMxZFZ5NDU1
aHJORmgvaktETmZGalJqSHhLcVo0ajNXcTANCnZHdkxQMEpTYTRKZlh6c3BPT1ZmSkhGYm1nMVVm
TFJVd2VVT3FXV3FBdlVQWVQ3c0JhNHh2eDN0bE1FTDI4enANCnpkTXAwMEdUTTlJaFhPK0FjTnph
VGRXakdpcU5sNGd2aHVoVjhuNTBYVlZpRStKMEJXN0xEQ2J5b2FMVXdBbmYNClJOQVVhc0lzWjRW
Skc1SEdhSGhEWnZjY1EzY3VQV2FSV0hWaWJnc0tZWFlSQ2NwT25CRkhxUW1DbDhWNGtBOEcNCm85
UnFkVFN6QkxZamQxTnJzZ3I1M0pFWG5oc0tkanBTbHFYOVJRdUJEd25ORk5pRkFwZlFYYzVmT2E4
Z3FoOE8NCll6eWdzUzU1a2RyK2dZa09yU1JRYU5EbFBZRmxQKytMc0JJdmNjRXNzSnY2ell4U3RL
OTFiSVI4TFlNcDlRU00NCjdCQkxrcWZPZGhKZnhOTFhtbzhwWVI0VG9TZTFCUEY5Uzc4b04vLy90
NUExR0FpY3lleDBvVXNkNmljM2laYlUNCkRKOW5KVUo2YzYzSW5YbUtOVTRCMU9kbklwY3l2RnZz
RTZZWGFFOXBiRExFQUh1eDRoRFhXeVFIeVY1d25TVzINClRRTzVvREd3KzBONDVXblp6V09MdUM2
WWllNmZpeEZ1NktTVU1mVjJVTG16UndZNW1HNFY4RlZSdHJRS2VuTT0NCj1DUUhZDQotLS0tLUVO
RCBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tDQo=

--b1=_v1Dm0eFLfJQ94gqxbHKdIjrELSzBaw9Wm75gUl4UkY
Content-Type: application/pgp-signature; name=OpenPGP_signature.asc
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=OpenPGP_signature.asc

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0NCg0KaVFJekJBRUJDZ0FkRmlFRUVjcGd3azVI
L0UycFI3bDdHNU8veTUzdCtxQUZBbW5oWDBvQUNna1FHNU8veTUzdA0KK3FEQnNRLy9iTy9DeWxu
S0tnMmZoYng0NGdoZDhkR2dEL0dkRkpGL20ycmlyRmU1YkE4d0xkUHphZnhLN2RyTw0KOEIrK0lj
ckM1QkUrMTBBbTI1M2RLc3Z1aHUyR0RndFpaS3ZqU3ByaFBQWnVjQitmNlQ2UldKbEdsdDFrMHRE
Vw0KWWp1b1pJY1loakd4N25jbWp4ejVEblFJcFBaTTdaZjdrS1VjZ2J0clhsczVwZzFHQjJjSTFu
TkVDU0Jwd3N0cA0KbHNFRmZvNGR3RW1FZUVnWXhLM3lqVXJVSWNPenNRU0tjMXZFSzBhWkUxN1Za
WUUvYlcxdVlVeGZya29jTUNiSg0KaEw0UDhvclh2UFlpczNyam16bXJYN2VRdjRqcVM5d24xSll5
OXIrRkszdVd0eEdPc1hQalpSWFl3OEliM1pFbA0KcFZPSDQvQ2o1cTF4a0VKNFc2d21kUWI3ajA5
L0ZncndjenJGTDBnajZTbW82SEJ3S2Q4ajFCeTl2YytEQ0Z3Vg0KV2RSTzZleHlhaFA3OE83emp0
Z0RKVnluNnlodEZPbFNSdlZsZHRVMGhzS3JlZW1QMGJudnFLNGpKSWNHZUFibQ0KTUlMY1U3VWtU
clFWSjVGMjltNEE1Vk9HVHhpVzQ5NXZDRTJkVVc3ZE5nV0tTTUtUNWVtU0N0WUpNS3AxYTNGbw0K
RmU1amhSbDNjdWp5clZ5QnovaWVkRXZ2RTdMYlhseWNPMzJFZUd1dWQ3UHFDM0RFdUlrY293a3ln
MEpFWFB4RA0KeURucXkrSzBQWE5tVVN1b3R1ZnhyU0EyTU41bHhHbzNCZHIzZTJMNlBOQ2VFdCtG
R1ZHUEhyYncybVE1MmVTbA0KdmJpYmFTMWVrWUFFQ2tEVStObkVyYkVYSnNVZEJYVXBzUWtJZWVs
Q3Fscy8xNE9XVXNvPQ0KPStFR0wNCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQ0K

--b1=_v1Dm0eFLfJQ94gqxbHKdIjrELSzBaw9Wm75gUl4UkY
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Gcrypt-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gcrypt-devel

--b1=_v1Dm0eFLfJQ94gqxbHKdIjrELSzBaw9Wm75gUl4UkY--