Adding OPENSSL_secure_zalloc and BIO_s_secmem

crypto/bio/bio_mem.c

@@ -303,3 +303,7 @@ int BIO_set_mem_buf(BIO *bio, BUF_MEM *b, int take_ownership) {
 int BIO_set_mem_eof_return(BIO *bio, int eof_value) {
   return (int)BIO_ctrl(bio, BIO_C_SET_BUF_MEM_EOF_RETURN, eof_value, NULL);
 }
+
+const BIO_METHOD *BIO_s_secmem(void) {
+    return BIO_s_mem();
+}

crypto/mem.c

@@ -329,6 +329,8 @@ size_t CRYPTO_secure_used(void) { return 0; }
 
 void *OPENSSL_secure_malloc(size_t size) { return OPENSSL_malloc(size); }
 
+void *OPENSSL_secure_zalloc(size_t size) { return OPENSSL_zalloc(size); }
+
 void OPENSSL_secure_clear_free(void *ptr, size_t len) {
   OPENSSL_clear_free(ptr, len);
 }

include/openssl/bio.h

@@ -447,6 +447,9 @@ OPENSSL_EXPORT int BIO_set_mem_buf(BIO *bio, BUF_MEM *b, int take_ownership);
 // default is -1 so that additional data can be written once exhausted.
 OPENSSL_EXPORT int BIO_set_mem_eof_return(BIO *bio, int eof_value);
 
+// Returns the normal BIO_METHOD |BIO_s_mem|. Deprecated since AWS-LC does not
+// support secure heaps.
+OPENSSL_EXPORT OPENSSL_DEPRECATED const BIO_METHOD *BIO_s_secmem(void);
 
 // BIO close flags.
 //

include/openssl/mem.h

@@ -247,8 +247,16 @@ OPENSSL_EXPORT int CRYPTO_secure_malloc_initialized(void);
 // CRYPTO_secure_used returns zero.
 OPENSSL_EXPORT size_t CRYPTO_secure_used(void);
 
+// OPENSSL supports the concept of secure heaps to help protect applications from pointer overruns or underruns that
+// could return arbitrary data from the program's dynamic memory area where sensitive information may be stored.
+// AWS-LC does not support secure heaps. Therefore, |OPENSSL_secure_malloc| and |OPENSSL_secure_zalloc| are
+// implemented as wrappers around their normal counterparts.
+
 // OPENSSL_secure_malloc calls |OPENSSL_malloc|.
-OPENSSL_EXPORT void *OPENSSL_secure_malloc(size_t size);
+OPENSSL_EXPORT OPENSSL_DEPRECATED void *OPENSSL_secure_malloc(size_t size);
+
+// OPENSSL_secure_zalloc calls |OPENSSL_zalloc|.
+OPENSSL_EXPORT OPENSSL_DEPRECATED void *OPENSSL_secure_zalloc(size_t size);
 
 // OPENSSL_secure_clear_free calls |OPENSSL_clear_free|.
 OPENSSL_EXPORT void OPENSSL_secure_clear_free(void *ptr, size_t len);