[30256] in CVS-changelog-for-Kerberos-V5
krb5 commit: Zap copy of secret in RC4 string-to-key
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Jul 16 10:10:25 2018
Date: Mon, 16 Jul 2018 10:10:19 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201807161410.w6GEAJZf019424@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/5d19f90f3216309c311507acbca2c8d0a286d632
commit 5d19f90f3216309c311507acbca2c8d0a286d632
Author: Dylan Gray <35609490+Dylan-MSFT@users.noreply.github.com>
Date: Fri Jul 13 15:09:01 2018 -0700
Zap copy of secret in RC4 string-to-key
Commit b8814745049b5f401e3ae39a81dc1e14598ae48c (ticket 8576) added a
zero-terminated copy of the input string in
krb5int_arcfour_string_to_key(). This copy should be zeroed when
freed as the input string typically contains a password.
[ghudson@mit.edu: rewrote commit message]
ticket: 8713 (new)
src/lib/crypto/krb/s2k_rc4.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/lib/crypto/krb/s2k_rc4.c b/src/lib/crypto/krb/s2k_rc4.c
index 081a912..f7e699d 100644
--- a/src/lib/crypto/krb/s2k_rc4.c
+++ b/src/lib/crypto/krb/s2k_rc4.c
@@ -25,7 +25,7 @@ krb5int_arcfour_string_to_key(const struct krb5_keytypes *ktp,
if (utf8 == NULL)
return err;
err = k5_utf8_to_utf16le(utf8, ©str, ©strlen);
- free(utf8);
+ zapfree(utf8, string->length);
if (err)
return err;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5