lib/mbedtls/sha1.c is U-Boot's own shim, not upstream mbedTLS code, and its sha1_hmac() has the same four clears as lib/sha1.c. It is the implementation used with CONFIG_SHA1_MBEDTLS, so it needs the same fix.
Cc: Tom Rini <[email protected]> Signed-off-by: Xiaoyi Suo <[email protected]> --- lib/mbedtls/sha1.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/mbedtls/sha1.c b/lib/mbedtls/sha1.c index 2aee50377..c6b92fbe7 100644 --- a/lib/mbedtls/sha1.c +++ b/lib/mbedtls/sha1.c @@ -92,8 +92,8 @@ void sha1_hmac(const unsigned char *key, int keylen, sha1_update(&ctx, tmpbuf, sizeof(tmpbuf)); sha1_finish(&ctx, output); - memset(k_ipad, 0, sizeof(k_ipad)); - memset(k_opad, 0, sizeof(k_opad)); - memset(tmpbuf, 0, sizeof(tmpbuf)); - memset(&ctx, 0, sizeof(sha1_context)); + memzero_explicit(k_ipad, sizeof(k_ipad)); + memzero_explicit(k_opad, sizeof(k_opad)); + memzero_explicit(tmpbuf, sizeof(tmpbuf)); + memzero_explicit(&ctx, sizeof(sha1_context)); } -- 2.43.0
