deps: update comment about PURIFY define

bnoordhuis · evanlucas · commit 62690aa0beaf · 2016-05-17T08:41:46.000-05:00
PURIFY makes OpenSSL zero out some buffers. It also stops RAND_bytes() from using the existing contents of the destination buffer as a source of entropy, which according to some papers, is a possible attack vector for reducing the overall entropy. PR-URL: #6582 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/deps/openssl/openssl.gypi b/deps/openssl/openssl.gypi
@@ -1244,10 +1244,14 @@
       'openssl/include',
     ],
     'openssl_default_defines_all': [
-      # No clue what these are for.
-      'PURIFY',
       '_REENTRANT',
 
+      # PURIFY makes OpenSSL zero out some buffers.  It also stops RAND_bytes()
+      # from using the existing contents of the destination buffer as a source
+      # of entropy, which according to some papers, is a possible attack vector
+      # for reducing the overall entropy.
+      'PURIFY',
+
       # Compression is not used and considered insecure (CRIME.)
       'OPENSSL_NO_COMP',
 
