Clear the sensitive data
diff --git a/cryptography/bindings/openssl/api.py b/cryptography/bindings/openssl/api.py
index abdaef0..20a85ca 100644
--- a/cryptography/bindings/openssl/api.py
+++ b/cryptography/bindings/openssl/api.py
@@ -42,6 +42,7 @@
int EVP_EncryptUpdate(EVP_CIPHER_CTX *, unsigned char *, int *,
unsigned char *, int);
int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *, unsigned char *, int *);
+ int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *);
""")
def create_block_cipher_context(self, cipher, mode):
@@ -78,6 +79,11 @@
if res == 0:
# TODO: figure out openssl errors
raise Exception
+ # TODO: this should also be called if the cipher isn't finalized.
+ res = self._lib.EVP_CIPHER_CTX_cleanup(ctx)
+ if res == 0:
+ # TODO: figure out openssl errors
+ raise Exception
return self._ffi.buffer(buf)[:outlen[0]]