Attention is currently required from: Arne Schwabe.
Hello Arne Schwabe,
I'd like you to do a code review.
Please visit
https://gerrit.openvpn.net/c/openvpn/+/2179?usp=email
to review the following change.
Change subject: auth-pam: wipe and free partial responses on conversation
failure
......................................................................
auth-pam: wipe and free partial responses on conversation failure
When a later message failed, my_conv() freed the response array but
not the responses already filled in, leaking copies of the password,
username or OTP without wiping them.
Change-Id: I793327150883ea0207bcb9724341e750bab92474
Signed-off-by: Razvan Cojocaru <[email protected]>
---
M src/plugins/auth-pam/auth-pam.c
1 file changed, 8 insertions(+), 0 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/79/2179/1
diff --git a/src/plugins/auth-pam/auth-pam.c b/src/plugins/auth-pam/auth-pam.c
index 948b6af..d179533 100644
--- a/src/plugins/auth-pam/auth-pam.c
+++ b/src/plugins/auth-pam/auth-pam.c
@@ -779,6 +779,14 @@
}
else
{
+ for (int i = 0; i < num_msg; ++i)
+ {
+ if (aresp[i].resp)
+ {
+ plugin_secure_memzero(aresp[i].resp, strlen(aresp[i].resp));
+ free(aresp[i].resp);
+ }
+ }
free(aresp);
}
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2179?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I793327150883ea0207bcb9724341e750bab92474
Gerrit-Change-Number: 2179
Gerrit-PatchSet: 1
Gerrit-Owner: Răzvan Cojocaru <[email protected]>
Gerrit-Reviewer: Arne Schwabe <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
