31 lines
1.0 KiB
Diff
31 lines
1.0 KiB
Diff
From 55a8161c3f5238df522447499a38bf2e9497b074 Mon Sep 17 00:00:00 2001
|
|
From: Dylan Gray <35609490+Dylan-MSFT@users.noreply.github.com>
|
|
Date: Fri, 13 Jul 2018 15:09:01 -0700
|
|
Subject: [PATCH] Zap copy of secret in RC4 string-to-key
|
|
|
|
Commit b8814745049b5f401e3ae39a81dc1e14598ae48c (ticket 8576) added a
|
|
zero-terminated copy of the input string in
|
|
krb5int_arcfour_string_to_key(). This copy should be zeroed when
|
|
freed as the input string typically contains a password.
|
|
|
|
[ghudson@mit.edu: rewrote commit message]
|
|
|
|
ticket: 8713 (new)
|
|
---
|
|
src/lib/crypto/krb/s2k_rc4.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/lib/crypto/krb/s2k_rc4.c b/src/lib/crypto/krb/s2k_rc4.c
|
|
index 081a91217..f7e699d60 100644
|
|
--- a/src/lib/crypto/krb/s2k_rc4.c
|
|
+++ b/src/lib/crypto/krb/s2k_rc4.c
|
|
@@ -25,7 +25,7 @@ krb5int_arcfour_string_to_key(const struct krb5_keytypes *ktp,
|
|
if (utf8 == NULL)
|
|
return err;
|
|
err = k5_utf8_to_utf16le(utf8, ©str, ©strlen);
|
|
- free(utf8);
|
|
+ zapfree(utf8, string->length);
|
|
if (err)
|
|
return err;
|
|
|