[30145] in CVS-changelog-for-Kerberos-V5
krb5 commit: Zap data when freeing krb5_spake_factor
daemon@ATHENA.MIT.EDU (Greg Hudson)
Fri Mar 30 21:07:30 2018
Date: Fri, 30 Mar 2018 21:07:20 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201803310107.w2V17KEe006782@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/9cc94a3f1ce06a4430f684300a747ec079102403
commit 9cc94a3f1ce06a4430f684300a747ec079102403
Author: Greg Hudson <ghudson@mit.edu>
Date: Tue Mar 27 15:42:28 2018 -0400
Zap data when freeing krb5_spake_factor
krb5_spake_factor structures will sometimes hold sensitive data when
second-factor SPAKE is implemented, so should be zapped when freed.
ticket: 8647
src/lib/krb5/krb/kfree.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/src/lib/krb5/krb/kfree.c b/src/lib/krb5/krb/kfree.c
index e1ea149..71e7fca 100644
--- a/src/lib/krb5/krb/kfree.c
+++ b/src/lib/krb5/krb/kfree.c
@@ -897,7 +897,9 @@ k5_free_spake_factor(krb5_context context, krb5_spake_factor *val)
{
if (val == NULL)
return;
- krb5_free_data(context, val->data);
+ if (val->data != NULL)
+ zapfree(val->data->data, val->data->length);
+ free(val->data);
free(val);
}
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
