Cryptopp: Crypto++ Memory Leak and Security Hole

[ISmileYouCryYouSmileIDie]

Crypto++ Issue Report : Security Hole

Hi , I think there's a mistake about crypto++ in memory allocation , every string we decrypt by cryptopp stores in memory and it never clean up itself , for example :

1. we have an AES encrypted code = "qDhMLeaughgJVzb4lnaCPJoSIXWUbahBTTQvPMJStbvYUvFCoNKeHCeaMfZQWJBpnCY"

1. we decrypt it using cryptopp , then we clean string from memory , Now if we create a full dump by Process Explorer
   We see 6 - 20 copy of decrypted string in memory :(

I have an important string that I have to send it privately to another win32 application and it can destroy everything !

What can I do ?

• State the operating system and version : Windows 10
• State the version of the Crypto++ library : Latest Version
• State how you built the library : Visual Studio 2017

[noloader]

What can I do ?

Use a SecByteBlock.

Please ask questions on the mailing list. Please reserve the bug tracker for library bugs.

[ISmileYouCryYouSmileIDie]

@noloader Sorry about that ! I searched about it but I couldn't find out how to use it , can you please send me an example or snippet ?
My Function is :

    std::string _d_c(const std::string& str_in, const std::string& key, const std::string& iv)
{

    std::string str_out;    
    CryptoPP::CFB_Mode<CryptoPP::AES>::Decryption decryption((byte*)key.c_str(), key.length(), (byte*)iv.c_str());

    CryptoPP::StringSource decryptor(str_in, true,
        new CryptoPP::Base64Decoder(
            new CryptoPP::StreamTransformationFilter(decryption,
                new CryptoPP::StringSink(str_out)
            )
        )
    );
    return str_out;
    str_out.clear();
}

How can i use SecByteBlockin it ? thanks again.

[smlu]

Have you tried SecByteBlockSink? See also SecBlock.

[ISmileYouCryYouSmileIDie]

dear @smlu , I tried this on my code based on what you sent

/// I added this headers

#include <Bits.h>
#include "secblock.h"
//// I used this code 
std::string dec = _d_c(test_string,aes_key,aes_iv);
CryptoPP::SecByteBlock key(reinterpret_cast<const byte*>(&dec[0], dec.size()));

but I get this error :

1>dllmain.cpp(370): error C2664: 'CryptoPP::SecBlock::SecBlock(unsigned int)' : cannot convert parameter 1 from 'const byte *' to 'unsigned int'
1> with
1> [
1> T=CryptoPP::byte
1> ]
1> There is no context in which this conversion is possible

What am I doing wrong ?

[smlu]

CryptoPP::SecByteBlock key(reinterpret_cast(&dec[0], dec.size()));

The reinterpret_cast args are wrong.
Try:
CryptoPP::SecByteBlock key(reinterpret_cast<const byte*>(&dec[0]), dec.size());

Note: I see this bug is also in the documentation, it will have to be fixed.

[noloader]

Note: I see this bug is also in the documentation, it will have to be fixed.

Done, thanks.