Zero out temporary arrays before use in PDF encryption.

core/src/fpdfapi/fpdf_parser/fpdf_parser_encrypt.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <time.h>
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fdrm/fx_crypt.h"
 const FX_BYTE defpasscode[32] = {
@@ skipping 388 matching lines @@
     if (m_Revision == 2) {
         FXSYS_memcpy32(ukeybuf, defpasscode, 32);
         CRYPT_ArcFourCryptBlock(ukeybuf, 32, key, key_len);
     } else {
         FX_BYTE test[32], tmpkey[32];
         FX_DWORD copy_len = sizeof(test);
         if (copy_len > (FX_DWORD)ukey.GetLength()) {
             copy_len = ukey.GetLength();
         }
         FXSYS_memset32(test, 0, sizeof(test));
+        FXSYS_memset32(tmpkey, 0, sizeof(tmpkey));
         FXSYS_memcpy32(test, (FX_LPCSTR)ukey, copy_len);
         for (int i = 19; i >= 0; i --) {
             for (int j = 0; j < key_len; j ++) {
                 tmpkey[j] = key[j] ^ i;
             }
             CRYPT_ArcFourCryptBlock(test, 32, tmpkey, key_len);
         }
         FX_BYTE md5[100];
         CRYPT_MD5Start(md5);
         CRYPT_MD5Update(md5, defpasscode, 32);
@@ skipping 40 matching lines @@
     if (okeylen > 32) {
         okeylen = 32;
     }
     FX_BYTE okeybuf[64];
     FXSYS_memcpy32(okeybuf, (FX_LPCSTR)okey, okeylen);
     if (m_Revision == 2) {
         CRYPT_ArcFourCryptBlock(okeybuf, okeylen, enckey, key_len);
     } else {
         for (int i = 19; i >= 0; i --) {
             FX_BYTE tempkey[32];
+            FXSYS_memset32(tempkey, 0, 32);

[palmer, 2014/07/10 18:27:32]

Use sizeof(tempkey) as above.

[Bo Xu, 2014/07/10 18:46:42]

Done

             for (int j = 0; j < m_KeyLen; j ++) {
                 tempkey[j] = enckey[j] ^ i;
             }
             CRYPT_ArcFourCryptBlock(okeybuf, okeylen, tempkey, key_len);
         }
     }
     int len = 32;
     while (len && defpasscode[len - 1] == okeybuf[len - 1]) {
         len --;
     }
@@ skipping 469 matching lines @@
     m_pAESContext = NULL;
     m_Cipher = FXCIPHER_NONE;
     m_KeyLen = 0;
 }
 CPDF_StandardCryptoHandler::~CPDF_StandardCryptoHandler()
 {
     if (m_pAESContext) {
         FX_Free(m_pAESContext);
     }
 }