the new function chunk_free_randomized() overwrites the contents of a chunk with pseudo-random bytes before freeing it

src/libstrongswan/chunk.c

@@ -28,6 +28,7 @@
 
 #include <debug.h>
 #include <printf_hook.h>
+#include <utils/randomizer.h>
 
 /**
  * Empty chunk.
@@ -257,6 +258,27 @@ void chunk_free(chunk_t *chunk)
 	chunk->len = 0;
 }
 
+/**
+ * Described in header.
+ */
+void chunk_free_randomized(chunk_t *chunk)
+{
+	if (chunk->ptr)
+	{
+		if (chunk->len > 0)
+		{
+			randomizer_t *randomizer = randomizer_create();
+
+			randomizer->get_pseudo_random_bytes(randomizer,
+												chunk->len, chunk->ptr);
+			randomizer->destroy(randomizer);
+		};
+		free(chunk->ptr);
+		chunk->ptr = NULL;
+	}
+	chunk->len = 0;
+}
+
 /**
  * Described in header.
  */

src/libstrongswan/chunk.h

@@ -88,6 +88,11 @@ bool chunk_write(chunk_t chunk, const char *path, const char *label, mode_t mask
  */
 void chunk_free(chunk_t *chunk);
 
+/**
+ * Overwrite the contents of a chunk with pseudo-random bytes and free them
+ */
+void chunk_free_randomized(chunk_t *chunk);
+
 /**
  * Initialize a chunk to point to buffer inspectable by sizeof()
  */