docs: refactor secure buffer management in cryptoops README
Introduce bufferGrow function for aligned growth to 16KB boundaries with memory wiping, simplify acquireBuffer logic by delegating growth and ensuring buffer initialization, and enhance secure memory handling to minimize allocations and protect sensitive data.
lemon-mint committed
Oct 27, 2025 at 14:46 UTC
c2ac5d0ea7d2621fe28ce0df02f7e68b1f89d404
1 file changed
+17
-6
relaydns/core/cryptoops/README.md
+17
-6
@@ -344,14 +344,25 @@ The implementation uses careful memory management to minimize allocations and pr
344
// Secure buffer pool for sensitive data
345
var _secureMemoryPool bytebufferpool.Pool
346
347
+func bufferGrow(buffer *bytebufferpool.ByteBuffer, n int) {
348
+ currentCap := cap(buffer.B)
349
+ if n > currentCap {
350
+ wipeMemory(buffer.B)
351
+ // Align to 16KB boundaries
352
+ newSize := (n + 16383) &^ 16383
353
+ buffer.B = make([]byte, 0, newSize)
354
+ }
355
+ buffer.B = buffer.B[:0]
356
+}
357
+
358
// Acquire buffer with auto-growing and alignment
359
func acquireBuffer(n int) *bytebufferpool.ByteBuffer {
349
- buffer := _secureMemoryPool.Get()
350
- if n > cap(buffer.B) {
351
- wipeMemory(buffer.B) // Zero old data
352
- buffer.B = make([]byte, ((n+(1<<14)-1)/1<<14)*(1<<14)) // 16KB aligned
353
- }
354
- return buffer
360
+ buffer := _secureMemoryPool.Get()
361
+ if buffer.B == nil {
362
+ buffer.B = make([]byte, 0)
363
+ }
364
+ bufferGrow(buffer, n)
365
+ return buffer
366
}
367
368
// Release and wipe buffer