Author: nhosoi
Update of /cvs/dirsec/adminserver/admserv/cgi-src40
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1705/admserv/cgi-src40
Modified Files:
sec-activate.c security.c viewlog.c
Log Message:
Resolves: #191834
Summary: Clean up admin password in memory when it's freed
Description: (comment #6)
Overwrote password strings with '\0's.
Index: sec-activate.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/sec-activate.c,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- sec-activate.c 4 Dec 2008 20:01:28 -0000 1.13
+++ sec-activate.c 28 Jan 2009 00:05:13 -0000 1.14
@@ -463,6 +463,7 @@
admSetCachedSIEPWD(pwd);
+ memset(pwd, 0, strlen(pwd));
free(pwd);
return admGetCachedSIEPWD();
Index: security.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/security.c,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- security.c 15 Dec 2008 20:06:55 -0000 1.19
+++ security.c 28 Jan 2009 00:05:13 -0000 1.20
@@ -505,7 +505,8 @@
PL_strfree(ssecurity);
PL_strfree(binddn);
if (freebindpw) {
- PL_strfree(bindpw);
+ memset(bindpw, 0, strlen(bindpw));
+ PL_strfree(bindpw);
}
}
}
Index: viewlog.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/viewlog.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- viewlog.c 4 Dec 2008 20:01:28 -0000 1.12
+++ viewlog.c 28 Jan 2009 00:05:13 -0000 1.13
@@ -269,7 +269,9 @@
PL_strfree(ssecurity);
PL_strfree(binddn);
if (freebindpw) {
+ memset(bindpw, 0, strlen(bindpw));
PL_strfree(bindpw);
+ bindpw = NULL;
}
}
}
Show replies by date