Date: Wed, 25 Aug 2021 17:11:43 -0300 From: "Jean D'Elboux" <j@....com.br> To: oss-security@...ts.openwall.com Subject: Re: Possible memory leak on getspnam / getspnam_r Thanks for your email Travis. > Alternatively, a new function cleanup_and_zeroize_caches() could added. A > user > could call this after fork(). > Yes, I've suggested something similar as an alternative (please check NB at the end of my email). > Of course, introducing a new function complicates the APIs and requires > developers to add them. Also, to support multiple versions of libraries, > developers would need to protect the call with an '#ifdef > SUPPORTS_NEW_FUNCTION'. > In order to avoid more complexity to the API, instead of creating a new function, endspent() could be bzero() internal buffer, since the user is expressing he/she is done processing when calling it.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.