fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2026-02-05 15:50:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

common: readline: fix memory leak of plain text secret

Browse source 
After a user entered a secret it would get stored in the readline
history data structure (in plain text) and eventually get leaked.

This commit instructs readline to not store any secret in its
history and fixes a non-related memory leak.
This commit is contained in:
Antonio Cardace 2019-12-18 13:42:06 +01:00
parent cfc418f887
commit 725cc68710
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
clients/cli/common.c
View file

@ -1005,7 +1005,7 @@ nmc_readline_echo (const NmcConfig *nmc_config,
va_list args;
gs_free char *prompt = NULL;
char *str;
HISTORY_STATE *saved_history;
nm_auto_free HISTORY_STATE *saved_history = NULL;
HISTORY_STATE passwd_history = { 0, };
va_start (args, prompt_fmt);
@ -1018,6 +1018,10 @@ nmc_readline_echo (const NmcConfig *nmc_config,
if (!echo_on) {
saved_history = history_get_history_state ();
history_set_history_state (&passwd_history);
/* stifling history is important as it tells readline to
* not store anything, otherwise sensitive data could be
* leaked */
stifle_history (0);
rl_redisplay_function = nmc_secret_redisplay;
}