From 2360ba1559ee8ea74717123d7dc5ae8046474b1d Mon Sep 17 00:00:00 2001
From: Tim Ruffing <crypto@timruffing.de>
Date: Fri, 27 Mar 2020 10:54:09 +0100
Subject: [PATCH] Add test for memczero()

---
 src/tests.c | 18 ++++++++++++++++++
 src/util.h  |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/tests.c b/src/tests.c
index 7edfa8a4fd..ee67d2104b 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -5166,6 +5166,21 @@ void run_ecdsa_openssl(void) {
 # include "modules/recovery/tests_impl.h"
 #endif
 
+void run_memczero_test(void) {
+  unsigned char buf1[6] = {1, 2, 3, 4, 5, 6};
+  unsigned char buf2[sizeof(buf1)];
+
+  /* memczero(..., ..., 0) is a noop. */
+  memcpy(buf2, buf1, sizeof(buf1));
+  memczero(buf1, sizeof(buf1), 0);
+  CHECK(memcmp(buf1, buf2, sizeof(buf1)) == 0);
+
+  /* memczero(..., ..., 1) zeros the buffer. */
+  memset(buf2, 0, sizeof(buf2));
+  memczero(buf1, sizeof(buf1) , 1);
+  CHECK(memcmp(buf1, buf2, sizeof(buf1)) == 0);
+}
+
 int main(int argc, char **argv) {
     unsigned char seed16[16] = {0};
     unsigned char run32[32] = {0};
@@ -5299,6 +5314,9 @@ int main(int argc, char **argv) {
     run_recovery_tests();
 #endif
 
+    /* util tests */
+    run_memczero_test();
+
     secp256k1_rand256(run32);
     printf("random run = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", run32[0], run32[1], run32[2], run32[3], run32[4], run32[5], run32[6], run32[7], run32[8], run32[9], run32[10], run32[11], run32[12], run32[13], run32[14], run32[15]);
 
diff --git a/src/util.h b/src/util.h
index 72e8be1c32..9a86e78757 100644
--- a/src/util.h
+++ b/src/util.h
@@ -160,7 +160,7 @@ static SECP256K1_INLINE void *manual_alloc(void** prealloc_ptr, size_t alloc_siz
 SECP256K1_GNUC_EXT typedef unsigned __int128 uint128_t;
 #endif
 
-/* Zero memory if flag == 1. Constant time. */
+/* Zero memory if flag == 1. Flag must be 0 or 1. Constant time. */
 static SECP256K1_INLINE void memczero(void *s, size_t len, int flag) {
     unsigned char *p = (unsigned char *)s;
     /* Access flag with a volatile-qualified lvalue.