Memory leak on secure channel key renewal (sopc_secure_connection_state_mgr.c).
When a new secure channel key is generated in SC_ClientTransitionHelper_ReceiveOPN
using SC_DeriveSymmetricKeySets
, the old key is not cleared. In addition, the precedent keysets are not properly updated causing problems when messages using the old keyset are received during the transition period.
Proposed fix: Change
result = SC_DeriveSymmetricKeySets(false, scConnection->cryptoProvider, scConnection->clientNonce,
secretServerNonce, &scConnection->currentSecuKeySets);
SOPC_SecretBuffer_DeleteClear(secretServerNonce);
to
// Delete the old-precedent key, save current as precedent and create new current.
SOPC_KeySet_Delete(scConnection->precedentSecuKeySets.receiverKeySet);
SOPC_KeySet_Delete(scConnection->precedentSecuKeySets.senderKeySet);
scConnection->precedentSecuKeySets = scConnection->currentSecuKeySets;
result = SC_DeriveSymmetricKeySets(false, scConnection->cryptoProvider, scConnection->clientNonce,
secretServerNonce, &scConnection->currentSecuKeySets);
SOPC_SecretBuffer_DeleteClear(secretServerNonce);
Edited by Tom van Groeningen