From af86a9a8b899eeb3c1c464cb0c54218acd788fa6 Mon Sep 17 00:00:00 2001 From: Hubert Chathi Date: Wed, 10 Oct 2018 15:06:58 -0400 Subject: clear out plaintext buffers in Android SDK where possible --- android/olm-sdk/src/main/jni/olm_session.cpp | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'android/olm-sdk/src/main/jni/olm_session.cpp') diff --git a/android/olm-sdk/src/main/jni/olm_session.cpp b/android/olm-sdk/src/main/jni/olm_session.cpp index 5ca49db..b9db286 100644 --- a/android/olm-sdk/src/main/jni/olm_session.cpp +++ b/android/olm-sdk/src/main/jni/olm_session.cpp @@ -472,6 +472,7 @@ JNIEXPORT jbyteArray OLM_SESSION_FUNC_DEF(encryptMessageJni)(JNIEnv *env, jobjec OlmSession *sessionPtr = getSessionInstanceId(env, thiz); jbyte *clearMsgPtr = NULL; + jboolean clearMsgIsCopied = JNI_FALSE; jclass encryptedMsgJClass = 0; jfieldID typeMsgFieldId; @@ -490,8 +491,9 @@ JNIEXPORT jbyteArray OLM_SESSION_FUNC_DEF(encryptMessageJni)(JNIEnv *env, jobjec else if (!aEncryptedMsg) { LOGE("## encryptMessageJni(): failure - invalid encrypted message"); + errorMessage = "invalid encrypted message"; } - else if (!(clearMsgPtr = env->GetByteArrayElements(aClearMsgBuffer, 0))) + else if (!(clearMsgPtr = env->GetByteArrayElements(aClearMsgBuffer, &clearMsgIsCopied))) { LOGE("## encryptMessageJni(): failure - clear message JNI allocation OOM"); errorMessage = "clear message JNI allocation OOM"; @@ -580,6 +582,10 @@ JNIEXPORT jbyteArray OLM_SESSION_FUNC_DEF(encryptMessageJni)(JNIEnv *env, jobjec // free alloc if (clearMsgPtr) { + if (clearMsgIsCopied) + { + memset(clearMsgPtr, 0, (size_t)env->GetArrayLength(aClearMsgBuffer)); + } env->ReleaseByteArrayElements(aClearMsgBuffer, clearMsgPtr, JNI_ABORT); } @@ -702,6 +708,8 @@ JNIEXPORT jbyteArray OLM_SESSION_FUNC_DEF(decryptMessageJni)(JNIEnv *env, jobjec LOGD(" ## decryptMessageJni(): UTF-8 Conversion - decrypted returnedLg=%lu OK",static_cast(plaintextLength)); } + + memset(plainTextMsgPtr, 0, maxPlainTextLength); } } @@ -958,4 +966,4 @@ JNIEXPORT jlong OLM_SESSION_FUNC_DEF(deserializeJni)(JNIEnv *env, jobject thiz, } return (jlong)(intptr_t)sessionPtr; -} \ No newline at end of file +} -- cgit v1.2.3