From: Razvan Cojocaru <[email protected]> When a later message failed, my_conv() freed the response array but not the responses already filled in, leaking copies of the password, username or OTP without wiping them.
Change-Id: I793327150883ea0207bcb9724341e750bab92474 Signed-off-by: Razvan Cojocaru <[email protected]> Acked-by: Frank Lichtenheld <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2179 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2179 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld <[email protected]> diff --git a/src/plugins/auth-pam/auth-pam.c b/src/plugins/auth-pam/auth-pam.c index 948b6af..d179533 100644 --- a/src/plugins/auth-pam/auth-pam.c +++ b/src/plugins/auth-pam/auth-pam.c @@ -779,6 +779,14 @@ } else { + for (int i = 0; i < num_msg; ++i) + { + if (aresp[i].resp) + { + plugin_secure_memzero(aresp[i].resp, strlen(aresp[i].resp)); + free(aresp[i].resp); + } + } free(aresp); } _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
