deps: update comment about PURIFY define

PURIFY makes OpenSSL zero out some buffers. It also stops RAND_bytes() from using the existing contents of the destination buffer as a source of entropy, which according to some papers, is a possible attack vector for reducing the overall entropy. PR-URL: #6582 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: James M Snell <[email protected]>
nodejs · May 17, 2016 · 62690aa · 62690aa
1 parent 477e61d
commit 62690aa
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/deps/openssl/openssl.gypi b/deps/openssl/openssl.gypi
@@ -1244,10 +1244,14 @@
       'openssl/include',
     ],
     'openssl_default_defines_all': [
-      # No clue what these are for.
-      'PURIFY',
       '_REENTRANT',
 
+      # PURIFY makes OpenSSL zero out some buffers.  It also stops RAND_bytes()
+      # from using the existing contents of the destination buffer as a source
+      # of entropy, which according to some papers, is a possible attack vector
+      # for reducing the overall entropy.
+      'PURIFY',
+
       # Compression is not used and considered insecure (CRIME.)
       'OPENSSL_NO_COMP',