Skip to content

Commit

Permalink
Use memset_s to clear auth password.
Browse files Browse the repository at this point in the history
There is a possibility that memset is optimised away, which would be
problematic when clearing the password. Thus we replace memset with
memset_s which has a far stricter language preventing this optimisation.
  • Loading branch information
dhruvCW committed Aug 3, 2023
1 parent 4090a79 commit 7139758
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/client.c
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
#include <errno.h>
#include <fcntl.h>
#include <string.h>

#include "trilogy/client.h"
#include "trilogy/error.h"
Expand Down Expand Up @@ -417,7 +418,7 @@ int trilogy_auth_switch_send(trilogy_conn_t *conn, const trilogy_handshake_t *ha
void trilogy_auth_clear_password(trilogy_conn_t *conn)
{
if (conn->socket->opts.password) {
memset(conn->socket->opts.password, 0, conn->socket->opts.password_len);
memset_s(conn->socket->opts.password, conn->socket->opts.password_len, 0, conn->socket->opts.password_len);
}
}

Expand Down

0 comments on commit 7139758

Please sign in to comment.