When CCrypter::SetKey() is called on an instance that already has a key set (fKeySet=true), the old key and IV are overwritten without being cleansed first. This can leave sensitive key material in memory longer than necessary.
This fix adds a call to CleanKey() before overwriting the key when fKeySet is already true, ensuring old key material is securely wiped before new key data is written
When CCrypter::SetKey() is called on an instance that already has a key
set (fKeySet=true), the old key and IV are overwritten without being
cleansed first. This can leave sensitive key material in memory longer
than necessary.
This fix adds a call to CleanKey() before overwriting the key when
fKeySet is already true, ensuring old key material is securely wiped
before new key data is written.
Add a test case to verify the behavior works correctly.
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--021abf342d371248e50ceaed478a90ca-->
See the guideline for information on the review process. A summary of reviews will appear here.
<!--5faf32d7da4f0f540f40219e4f7537a3-->