Skip to content

Commit 62690aa

Browse files
bnoordhuisevanlucas
authored andcommitted
deps: update comment about PURIFY define
PURIFY makes OpenSSL zero out some buffers. It also stops RAND_bytes() from using the existing contents of the destination buffer as a source of entropy, which according to some papers, is a possible attack vector for reducing the overall entropy. PR-URL: #6582 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: James M Snell <[email protected]>
1 parent 477e61d commit 62690aa

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

deps/openssl/openssl.gypi

+6-2
Original file line numberDiff line numberDiff line change
@@ -1244,10 +1244,14 @@
12441244
'openssl/include',
12451245
],
12461246
'openssl_default_defines_all': [
1247-
# No clue what these are for.
1248-
'PURIFY',
12491247
'_REENTRANT',
12501248

1249+
# PURIFY makes OpenSSL zero out some buffers. It also stops RAND_bytes()
1250+
# from using the existing contents of the destination buffer as a source
1251+
# of entropy, which according to some papers, is a possible attack vector
1252+
# for reducing the overall entropy.
1253+
'PURIFY',
1254+
12511255
# Compression is not used and considered insecure (CRIME.)
12521256
'OPENSSL_NO_COMP',
12531257

0 commit comments

Comments
 (0)