[SANTUARIO-68] HMAC signature verification leaks with OpenSSL

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: C++ 1.6.0
• Component/s: C++
• Security Level: Public (Public issues, viewable by everyone)
• Environment: Operating System: All; Platform: Other
• Bugzilla Id: 38604
• Assignee: Unassigned
• Reporter: Steen Kroyer
• Created: 10/Feb/06 15:39
• Updated: 16/Feb/11 21:59
• Resolved: 07/Dec/10 18:33

Description

• This holds for XML Security C++ 1.2.1 *
  (I was unable to choose that version in Bugzilla)
  —

In the file OpenSSLCryptoHashHMAC.cpp the destructor should be changed from
simply (line 136):

OpenSSLCryptoHashHMAC::~OpenSSLCryptoHashHMAC() {}

to

OpenSSLCryptoHashHMAC::~OpenSSLCryptoHashHMAC() {
HMAC_CTX_cleanup(&m_hctx);
}

Otherwise a leak occurs each time an HMAC signed signature is verified.