Re: [PATCH] Wipe out Lisp password data using memset(), not #'fill

Jerry James <[email protected]> Fri, 17 Apr 2015 14:32:41 -0600

Newsgroups	gmane.emacs.xemacs.patches
Message-ID	<CAHCOHQmUWFbp+Gm_2RacFBEmdX=P2sO782L_9ch984=xV+ei9Q@mail.gmail.com>

On Sat, Apr 11, 2015 at 2:04 PM, Aidan Kehoe <[email protected]> wrote:
>
> Hi Jerry --
>
> This also struck me when scrolling through tls.c.
>
> Best,
>
> Aidan
>
> 2015-04-11  Aidan Kehoe  <[email protected]>
>
>         * tls.c (nss_pk11_password):
>         * tls.c (gnutls_pk11_password):
>         * tls.c (openssl_password):
>         Wipe out the Lisp string password using memset() rather than
>         #'fill, which can reallocate the string data when a string's byte
>         length changes.

Ah, good catch.  Yes, please commit this.
-- 
Jerry James
http://www.jamezone.org/