From 9f37dad55f82471f3978e79780bf3032a79074df Mon Sep 17 00:00:00 2001
From: Ted Unangst <tedu@cvs.openbsd.org>
Date: Fri, 31 Jan 2014 16:39:20 +0000
Subject: replace most bzero with explicit_bzero, except a few that cna be
 memset ok djm dtucker

---
 usr.bin/ssh/auth2-chall.c       |  4 ++--
 usr.bin/ssh/authfd.c            |  4 ++--
 usr.bin/ssh/authfile.c          |  8 ++++----
 usr.bin/ssh/bufaux.c            |  4 ++--
 usr.bin/ssh/bufec.c             |  6 +++---
 usr.bin/ssh/channels.c          | 10 ++++------
 usr.bin/ssh/cipher-chachapoly.c | 10 +++++-----
 usr.bin/ssh/clientloop.c        |  6 +++---
 usr.bin/ssh/hmac.c              |  8 ++++----
 usr.bin/ssh/hostfile.c          |  6 +++---
 usr.bin/ssh/kexc25519.c         |  4 ++--
 usr.bin/ssh/krl.c               | 12 ++++++------
 usr.bin/ssh/monitor.c           |  4 ++--
 usr.bin/ssh/sandbox-systrace.c  |  4 ++--
 usr.bin/ssh/session.c           |  4 ++--
 usr.bin/ssh/sftp-client.c       |  4 ++--
 usr.bin/ssh/ssh-keygen.c        |  4 ++--
 usr.bin/ssh/ssh.c               | 12 ++++++------
 usr.bin/ssh/sshconnect2.c       |  4 ++--
 usr.bin/ssh/sshd.c              |  8 ++++----
 usr.bin/ssh/sshlogin.c          |  4 ++--
 21 files changed, 64 insertions(+), 66 deletions(-)

diff --git a/usr.bin/ssh/auth2-chall.c b/usr.bin/ssh/auth2-chall.c
index a5cf992c359..364629e7c34 100644
--- a/usr.bin/ssh/auth2-chall.c
+++ b/usr.bin/ssh/auth2-chall.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-chall.c,v 1.39 2013/11/08 00:39:14 djm Exp $ */
+/* $OpenBSD: auth2-chall.c,v 1.40 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2001 Per Allansson.  All rights reserved.
@@ -103,7 +103,7 @@ kbdint_free(KbdintAuthctxt *kbdintctxt)
 	if (kbdintctxt->device)
 		kbdint_reset_device(kbdintctxt);
 	free(kbdintctxt->devices);
-	bzero(kbdintctxt, sizeof(*kbdintctxt));
+	explicit_bzero(kbdintctxt, sizeof(*kbdintctxt));
 	free(kbdintctxt);
 }
 /* get next device */
diff --git a/usr.bin/ssh/authfd.c b/usr.bin/ssh/authfd.c
index 586d008506b..9d617509606 100644
--- a/usr.bin/ssh/authfd.c
+++ b/usr.bin/ssh/authfd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfd.c,v 1.91 2013/12/29 04:29:25 djm Exp $ */
+/* $OpenBSD: authfd.c,v 1.92 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -100,7 +100,7 @@ ssh_get_authentication_socket(void)
 	if (!authsocket)
 		return -1;
 
-	bzero(&sunaddr, sizeof(sunaddr));
+	memset(&sunaddr, 0, sizeof(sunaddr));
 	sunaddr.sun_family = AF_UNIX;
 	strlcpy(sunaddr.sun_path, authsocket, sizeof(sunaddr.sun_path));
 
diff --git a/usr.bin/ssh/authfile.c b/usr.bin/ssh/authfile.c
index 70bb814fec6..610602807b3 100644
--- a/usr.bin/ssh/authfile.c
+++ b/usr.bin/ssh/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.101 2013/12/29 04:35:50 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.102 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -690,17 +690,17 @@ key_load_file(int fd, const char *filename, Buffer *blob)
 			    __func__, filename == NULL ? "" : filename,
 			    filename == NULL ? "" : " ", strerror(errno));
 			buffer_clear(blob);
-			bzero(buf, sizeof(buf));
+			explicit_bzero(buf, sizeof(buf));
 			return 0;
 		}
 		buffer_append(blob, buf, len);
 		if (buffer_len(blob) > MAX_KEY_FILE_SIZE) {
 			buffer_clear(blob);
-			bzero(buf, sizeof(buf));
+			explicit_bzero(buf, sizeof(buf));
 			goto toobig;
 		}
 	}
-	bzero(buf, sizeof(buf));
+	explicit_bzero(buf, sizeof(buf));
 	if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
 	    st.st_size != buffer_len(blob)) {
 		debug("%s: key file %.200s%schanged size while reading",
diff --git a/usr.bin/ssh/bufaux.c b/usr.bin/ssh/bufaux.c
index 011722b3bd4..501c11029ec 100644
--- a/usr.bin/ssh/bufaux.c
+++ b/usr.bin/ssh/bufaux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufaux.c,v 1.54 2014/01/12 08:13:13 djm Exp $ */
+/* $OpenBSD: bufaux.c,v 1.55 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -214,7 +214,7 @@ buffer_get_cstring_ret(Buffer *buffer, u_int *length_ptr)
 		if (cp == ret + length - 1)
 			error("buffer_get_cstring_ret: string contains \\0");
 		else {
-			bzero(ret, length);
+			explicit_bzero(ret, length);
 			free(ret);
 			return NULL;
 		}
diff --git a/usr.bin/ssh/bufec.c b/usr.bin/ssh/bufec.c
index a3825cf6e4f..f326b4e2fcd 100644
--- a/usr.bin/ssh/bufec.c
+++ b/usr.bin/ssh/bufec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufec.c,v 1.2 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: bufec.c,v 1.3 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 2010 Damien Miller <djm@mindrot.org>
  *
@@ -72,7 +72,7 @@ buffer_put_ecpoint_ret(Buffer *buffer, const EC_GROUP *curve,
 	ret = 0;
  out:
 	if (buf != NULL) {
-		bzero(buf, len);
+		explicit_bzero(buf, len);
 		free(buf);
 	}
 	BN_CTX_free(bnctx);
@@ -125,7 +125,7 @@ buffer_get_ecpoint_ret(Buffer *buffer, const EC_GROUP *curve,
 	ret = 0;
  out:
 	BN_CTX_free(bnctx);
-	bzero(buf, len);
+	explicit_bzero(buf, len);
 	free(buf);
 	return ret;
 }
diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c
index 32156413b23..44ce806e1e8 100644
--- a/usr.bin/ssh/channels.c
+++ b/usr.bin/ssh/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.328 2013/12/19 01:04:36 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.329 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -415,7 +415,7 @@ channel_free(Channel *c)
 		if (cc->abandon_cb != NULL)
 			cc->abandon_cb(c, cc->ctx);
 		TAILQ_REMOVE(&c->status_confirms, cc, entry);
-		bzero(cc, sizeof(*cc));
+		explicit_bzero(cc, sizeof(*cc));
 		free(cc);
 	}
 	if (c->filter_cleanup != NULL && c->filter_ctx != NULL)
@@ -2646,7 +2646,7 @@ channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
 		return;
 	cc->cb(type, c, cc->ctx);
 	TAILQ_REMOVE(&c->status_confirms, cc, entry);
-	bzero(cc, sizeof(*cc));
+	explicit_bzero(cc, sizeof(*cc));
 	free(cc);
 }
 
@@ -3271,9 +3271,7 @@ channel_connect_ctx_free(struct channel_connect *cctx)
 	free(cctx->host);
 	if (cctx->aitop)
 		freeaddrinfo(cctx->aitop);
-	bzero(cctx, sizeof(*cctx));
-	cctx->host = NULL;
-	cctx->ai = cctx->aitop = NULL;
+	memset(cctx, 0, sizeof(*cctx));
 }
 
 /* Return CONNECTING channel to remote host, port */
diff --git a/usr.bin/ssh/cipher-chachapoly.c b/usr.bin/ssh/cipher-chachapoly.c
index 9a7bb773540..123f5a7539c 100644
--- a/usr.bin/ssh/cipher-chachapoly.c
+++ b/usr.bin/ssh/cipher-chachapoly.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $OpenBSD: cipher-chachapoly.c,v 1.3 2013/12/15 21:42:35 djm Exp $ */
+/* $OpenBSD: cipher-chachapoly.c,v 1.4 2014/01/31 16:39:19 tedu Exp $ */
 
 #include <sys/types.h>
 #include <stdarg.h> /* needed for log.h */
@@ -56,7 +56,7 @@ chachapoly_crypt(struct chachapoly_ctx *ctx, u_int seqnr, u_char *dest,
 	 * Run ChaCha20 once to generate the Poly1305 key. The IV is the
 	 * packet sequence number.
 	 */
-	bzero(poly_key, sizeof(poly_key));
+	memset(poly_key, 0, sizeof(poly_key));
 	put_u64(seqbuf, seqnr);
 	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
 	chacha_encrypt_bytes(&ctx->main_ctx,
@@ -88,9 +88,9 @@ chachapoly_crypt(struct chachapoly_ctx *ctx, u_int seqnr, u_char *dest,
 	r = 0;
 
  out:
-	bzero(expected_tag, sizeof(expected_tag));
-	bzero(seqbuf, sizeof(seqbuf));
-	bzero(poly_key, sizeof(poly_key));
+	explicit_bzero(expected_tag, sizeof(expected_tag));
+	explicit_bzero(seqbuf, sizeof(seqbuf));
+	explicit_bzero(poly_key, sizeof(poly_key));
 	return r;
 }
 
diff --git a/usr.bin/ssh/clientloop.c b/usr.bin/ssh/clientloop.c
index 3d9dd4399a9..71553e592c7 100644
--- a/usr.bin/ssh/clientloop.c
+++ b/usr.bin/ssh/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.256 2013/11/20 20:54:10 deraadt Exp $ */
+/* $OpenBSD: clientloop.c,v 1.257 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -541,7 +541,7 @@ client_global_request_reply(int type, u_int32_t seq, void *ctxt)
 		gc->cb(type, seq, gc->ctx);
 	if (--gc->ref_count <= 0) {
 		TAILQ_REMOVE(&global_confirms, gc, entry);
-		bzero(gc, sizeof(*gc));
+		explicit_bzero(gc, sizeof(*gc));
 		free(gc);
 	}
 
@@ -867,7 +867,7 @@ process_cmdline(void)
 	int cancel_port, ok;
 	Forward fwd;
 
-	bzero(&fwd, sizeof(fwd));
+	memset(&fwd, 0, sizeof(fwd));
 	fwd.listen_host = fwd.connect_host = NULL;
 
 	leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
diff --git a/usr.bin/ssh/hmac.c b/usr.bin/ssh/hmac.c
index cdd98ff1c79..947715e5c53 100644
--- a/usr.bin/ssh/hmac.c
+++ b/usr.bin/ssh/hmac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: hmac.c,v 1.9 2014/01/27 18:58:14 markus Exp $ */
+/* $OpenBSD: hmac.c,v 1.10 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 2014 Markus Friedl.  All rights reserved.
  *
@@ -79,7 +79,7 @@ ssh_hmac_init(struct ssh_hmac_ctx *ctx, const void *key, size_t klen)
 			ctx->buf[i] ^= 0x36 ^ 0x5c;
 		if (ssh_digest_update(ctx->octx, ctx->buf, ctx->buf_len) < 0)
 			return -1;
-		bzero(ctx->buf, ctx->buf_len);
+		explicit_bzero(ctx->buf, ctx->buf_len);
 	}
 	/* start with ictx */
 	if (ssh_digest_copy_state(ctx->ictx, ctx->digest) < 0)
@@ -124,10 +124,10 @@ ssh_hmac_free(struct ssh_hmac_ctx *ctx)
 		ssh_digest_free(ctx->octx);
 		ssh_digest_free(ctx->digest);
 		if (ctx->buf) {
-			bzero(ctx->buf, ctx->buf_len);
+			explicit_bzero(ctx->buf, ctx->buf_len);
 			free(ctx->buf);
 		}
-		bzero(ctx, sizeof(*ctx));
+		explicit_bzero(ctx, sizeof(*ctx));
 		free(ctx);
 	}
 }
diff --git a/usr.bin/ssh/hostfile.c b/usr.bin/ssh/hostfile.c
index e533a76495d..440363d5848 100644
--- a/usr.bin/ssh/hostfile.c
+++ b/usr.bin/ssh/hostfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: hostfile.c,v 1.54 2014/01/27 18:58:14 markus Exp $ */
+/* $OpenBSD: hostfile.c,v 1.55 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -330,10 +330,10 @@ free_hostkeys(struct hostkeys *hostkeys)
 		free(hostkeys->entries[i].host);
 		free(hostkeys->entries[i].file);
 		key_free(hostkeys->entries[i].key);
-		bzero(hostkeys->entries + i, sizeof(*hostkeys->entries));
+		explicit_bzero(hostkeys->entries + i, sizeof(*hostkeys->entries));
 	}
 	free(hostkeys->entries);
-	bzero(hostkeys, sizeof(*hostkeys));
+	explicit_bzero(hostkeys, sizeof(*hostkeys));
 	free(hostkeys);
 }
 
diff --git a/usr.bin/ssh/kexc25519.c b/usr.bin/ssh/kexc25519.c
index 019534a3e26..135a443ffbd 100644
--- a/usr.bin/ssh/kexc25519.c
+++ b/usr.bin/ssh/kexc25519.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexc25519.c,v 1.4 2014/01/12 08:13:13 djm Exp $ */
+/* $OpenBSD: kexc25519.c,v 1.5 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 2001, 2013 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -68,7 +68,7 @@ kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
 #endif
 	buffer_clear(out);
 	buffer_put_bignum2_from_string(out, shared_key, CURVE25519_SIZE);
-	memset(shared_key, 0, CURVE25519_SIZE);	/* XXX explicit_bzero() */
+	explicit_bzero(shared_key, CURVE25519_SIZE);
 }
 
 void
diff --git a/usr.bin/ssh/krl.c b/usr.bin/ssh/krl.c
index 57efdc2f6d5..0a9e065a5c9 100644
--- a/usr.bin/ssh/krl.c
+++ b/usr.bin/ssh/krl.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $OpenBSD: krl.c,v 1.13 2013/07/20 22:20:42 djm Exp $ */
+/* $OpenBSD: krl.c,v 1.14 2014/01/31 16:39:19 tedu Exp $ */
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -236,7 +236,7 @@ insert_serial_range(struct revoked_serial_tree *rt, u_int64_t lo, u_int64_t hi)
 	struct revoked_serial rs, *ers, *crs, *irs;
 
 	KRL_DBG(("%s: insert %llu:%llu", __func__, lo, hi));
-	bzero(&rs, sizeof(rs));
+	memset(&rs, 0, sizeof(rs));
 	rs.lo = lo;
 	rs.hi = hi;
 	ers = RB_NFIND(revoked_serial_tree, rt, &rs);
@@ -1113,7 +1113,7 @@ is_key_revoked(struct ssh_krl *krl, const Key *key)
 	struct revoked_certs *rc;
 
 	/* Check explicitly revoked hashes first */
-	bzero(&rb, sizeof(rb));
+	memset(&rb, 0, sizeof(rb));
 	if ((rb.blob = key_fingerprint_raw(key, SSH_FP_SHA1, &rb.len)) == NULL)
 		return -1;
 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
@@ -1124,7 +1124,7 @@ is_key_revoked(struct ssh_krl *krl, const Key *key)
 	}
 
 	/* Next, explicit keys */
-	bzero(&rb, sizeof(rb));
+	memset(&rb, 0, sizeof(rb));
 	if (plain_key_blob(key, &rb.blob, &rb.len) != 0)
 		return -1;
 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
@@ -1145,7 +1145,7 @@ is_key_revoked(struct ssh_krl *krl, const Key *key)
 		return 0; /* No entry for this CA */
 
 	/* Check revocation by cert key ID */
-	bzero(&rki, sizeof(rki));
+	memset(&rki, 0, sizeof(rki));
 	rki.key_id = key->cert->key_id;
 	erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
 	if (erki != NULL) {
@@ -1160,7 +1160,7 @@ is_key_revoked(struct ssh_krl *krl, const Key *key)
 	if (key_cert_is_legacy(key) || key->cert->serial == 0)
 		return 0;
 
-	bzero(&rs, sizeof(rs));
+	memset(&rs, 0, sizeof(rs));
 	rs.lo = rs.hi = key->cert->serial;
 	ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
 	if (ers != NULL) {
diff --git a/usr.bin/ssh/monitor.c b/usr.bin/ssh/monitor.c
index 8adc7d5f31a..175bb8931d8 100644
--- a/usr.bin/ssh/monitor.c
+++ b/usr.bin/ssh/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.129 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.130 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -452,7 +452,7 @@ monitor_read(struct monitor *pmonitor, struct mon_table *ent,
 	struct pollfd pfd[2];
 
 	for (;;) {
-		bzero(&pfd, sizeof(pfd));
+		memset(&pfd, 0, sizeof(pfd));
 		pfd[0].fd = pmonitor->m_sendfd;
 		pfd[0].events = POLLIN;
 		pfd[1].fd = pmonitor->m_log_recvfd;
diff --git a/usr.bin/ssh/sandbox-systrace.c b/usr.bin/ssh/sandbox-systrace.c
index 88089dedc11..5f83fbcdf12 100644
--- a/usr.bin/ssh/sandbox-systrace.c
+++ b/usr.bin/ssh/sandbox-systrace.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sandbox-systrace.c,v 1.8 2014/01/30 22:26:14 djm Exp $ */
+/* $OpenBSD: sandbox-systrace.c,v 1.9 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
  *
@@ -138,7 +138,7 @@ ssh_sandbox_parent(struct ssh_sandbox *box, pid_t child_pid,
 		    box->systrace_fd, child_pid, strerror(errno));
 
 	/* Allocate and assign policy */
-	bzero(&policy, sizeof(policy));
+	memset(&policy, 0, sizeof(policy));
 	policy.strp_op = SYSTR_POLICY_NEW;
 	policy.strp_maxents = SYS_MAXSYSCALL;
 	if (ioctl(box->systrace_fd, STRIOCPOLICY, &policy) == -1)
diff --git a/usr.bin/ssh/session.c b/usr.bin/ssh/session.c
index 9bbd8e2038c..09a07873fe4 100644
--- a/usr.bin/ssh/session.c
+++ b/usr.bin/ssh/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.269 2014/01/18 09:36:26 dtucker Exp $ */
+/* $OpenBSD: session.c,v 1.270 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -1522,7 +1522,7 @@ session_unused(int id)
 		fatal("%s: insane session id %d (max %d nalloc %d)",
 		    __func__, id, options.max_sessions, sessions_nalloc);
 	}
-	bzero(&sessions[id], sizeof(*sessions));
+	memset(&sessions[id], 0, sizeof(*sessions));
 	sessions[id].self = id;
 	sessions[id].used = 0;
 	sessions[id].chanid = -1;
diff --git a/usr.bin/ssh/sftp-client.c b/usr.bin/ssh/sftp-client.c
index e69f7fe4188..32253067479 100644
--- a/usr.bin/ssh/sftp-client.c
+++ b/usr.bin/ssh/sftp-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-client.c,v 1.113 2014/01/17 00:21:06 djm Exp $ */
+/* $OpenBSD: sftp-client.c,v 1.114 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -303,7 +303,7 @@ get_decode_statvfs(struct sftp_conn *conn, struct sftp_statvfs *st,
 		    SSH2_FXP_EXTENDED_REPLY, type);
 	}
 
-	bzero(st, sizeof(*st));
+	memset(st, 0, sizeof(*st));
 	st->f_bsize = buffer_get_int64(&msg);
 	st->f_frsize = buffer_get_int64(&msg);
 	st->f_blocks = buffer_get_int64(&msg);
diff --git a/usr.bin/ssh/ssh-keygen.c b/usr.bin/ssh/ssh-keygen.c
index ddb8d696df8..368d6772456 100644
--- a/usr.bin/ssh/ssh-keygen.c
+++ b/usr.bin/ssh/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.238 2013/12/06 13:39:49 markus Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.239 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1701,7 +1701,7 @@ parse_absolute_time(const char *s)
 		fatal("Invalid certificate time format %s", s);
 	}
 
-	bzero(&tm, sizeof(tm));
+	memset(&tm, 0, sizeof(tm));
 	if (strptime(buf, fmt, &tm) == NULL)
 		fatal("Invalid certificate time %s", s);
 	if ((tt = mktime(&tm)) < 0)
diff --git a/usr.bin/ssh/ssh.c b/usr.bin/ssh/ssh.c
index e0950c2cbcc..94cc3ae0052 100644
--- a/usr.bin/ssh/ssh.c
+++ b/usr.bin/ssh/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.397 2013/12/29 05:42:16 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.398 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -226,7 +226,7 @@ resolve_host(const char *name, u_int port, int logerr, char *cname, size_t clen)
 	int gaierr, loglevel = SYSLOG_LEVEL_DEBUG1;
 
 	snprintf(strport, sizeof strport, "%u", port);
-	bzero(&hints, sizeof(hints));
+	memset(&hints, 0, sizeof(hints));
 	hints.ai_family = options.address_family;
 	hints.ai_socktype = SOCK_STREAM;
 	if (cname != NULL)
@@ -1649,8 +1649,8 @@ load_public_identity_files(void)
 #endif /* PKCS11 */
 
 	n_ids = 0;
-	bzero(identity_files, sizeof(identity_files));
-	bzero(identity_keys, sizeof(identity_keys));
+	memset(identity_files, 0, sizeof(identity_files));
+	memset(identity_keys, 0, sizeof(identity_keys));
 
 #ifdef ENABLE_PKCS11
 	if (options.pkcs11_provider != NULL &&
@@ -1725,9 +1725,9 @@ load_public_identity_files(void)
 	memcpy(options.identity_files, identity_files, sizeof(identity_files));
 	memcpy(options.identity_keys, identity_keys, sizeof(identity_keys));
 
-	bzero(pwname, strlen(pwname));
+	explicit_bzero(pwname, strlen(pwname));
 	free(pwname);
-	bzero(pwdir, strlen(pwdir));
+	explicit_bzero(pwdir, strlen(pwdir));
 	free(pwdir);
 }
 
diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c
index 00cc89033d8..85c6717b6fa 100644
--- a/usr.bin/ssh/sshconnect2.c
+++ b/usr.bin/ssh/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.202 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.203 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -1184,7 +1184,7 @@ pubkey_prepare(Authctxt *authctxt)
 		/* If IdentitiesOnly set and key not found then don't use it */
 		if (!found && options.identities_only) {
 			TAILQ_REMOVE(&files, id, next);
-			bzero(id, sizeof(*id));
+			explicit_bzero(id, sizeof(*id));
 			free(id);
 		}
 	}
diff --git a/usr.bin/ssh/sshd.c b/usr.bin/ssh/sshd.c
index a07cf85d372..f0cad5698cb 100644
--- a/usr.bin/ssh/sshd.c
+++ b/usr.bin/ssh/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.416 2014/01/29 00:19:26 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.417 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -600,7 +600,7 @@ privsep_preauth_child(void)
 
 	arc4random_buf(rnd, sizeof(rnd));
 	RAND_seed(rnd, sizeof(rnd));
-	bzero(rnd, sizeof(rnd));
+	explicit_bzero(rnd, sizeof(rnd));
 
 	/* Demote the private keys to public keys. */
 	demote_sensitive_data();
@@ -736,7 +736,7 @@ privsep_postauth(Authctxt *authctxt)
 
 	arc4random_buf(rnd, sizeof(rnd));
 	RAND_seed(rnd, sizeof(rnd));
-	bzero(rnd, sizeof(rnd));
+	explicit_bzero(rnd, sizeof(rnd));
 
 	/* Drop privileges */
 	do_setusercontext(authctxt->pw);
@@ -1317,7 +1317,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
 			 */
 			arc4random_buf(rnd, sizeof(rnd));
 			RAND_seed(rnd, sizeof(rnd));
-			bzero(rnd, sizeof(rnd));
+			explicit_bzero(rnd, sizeof(rnd));
 		}
 
 		/* child process check (or debug mode) */
diff --git a/usr.bin/ssh/sshlogin.c b/usr.bin/ssh/sshlogin.c
index 36756a963d8..601d0728d85 100644
--- a/usr.bin/ssh/sshlogin.c
+++ b/usr.bin/ssh/sshlogin.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshlogin.c,v 1.27 2011/01/11 06:06:09 djm Exp $ */
+/* $OpenBSD: sshlogin.c,v 1.28 2014/01/31 16:39:19 tedu Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -164,7 +164,7 @@ record_login(pid_t pid, const char *tty, const char *user, uid_t uid,
 	/* Update lastlog unless actually recording a logout. */
 	if (strcmp(user, "") != 0) {
 		/*
-		 * It is safer to bzero the lastlog structure first because
+		 * It is safer to memset the lastlog structure first because
 		 * some systems might have some extra fields in it (e.g. SGI)
 		 */
 		memset(&ll, 0, sizeof(ll));
-- 
cgit v1.2.3