[Fedora-directory-commits] mod_admserv mod_admserv.c,1.37,1.38

[Noriko Hosoi]

Author: nhosoi

Update of /cvs/dirsec/mod_admserv
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1705/mod_admserv

Modified Files:
	mod_admserv.c 
Log Message:
Resolves: #191834
Summary: Clean up admin password in memory when it's freed
Description: (comment #6)
Overwrote password strings with '\0's.



Index: mod_admserv.c
===================================================================
RCS file: /cvs/dirsec/mod_admserv/mod_admserv.c,v
retrieving revision 1.37
retrieving revision 1.38
diff -u -r1.37 -r1.38
--- mod_admserv.c	12 Dec 2008 19:45:05 -0000	1.37
+++ mod_admserv.c	28 Jan 2009 00:05:13 -0000	1.38
@@ -886,25 +886,28 @@
     
         if (error != UG_OP_OK) {
             *errorInfo = (char*)"unable to set User/Group baseDN";
-			goto done;
+            goto done;
         }
     }
 
     if (!extractLdapServerData(&userGroupServer, userGroupLdapURL, s)) {
         *errorInfo = (char*)"unable to extract User/Group LDAP info";
-		goto done;
+        goto done;
     }
     userGroupServer.bindDN = userGroupBindDN ? apr_pstrdup(module_pool, userGroupBindDN) : NULL;
     userGroupServer.bindPW = userGroupBindPW ? apr_pstrdup(module_pool, userGroupBindPW) : NULL;
-	retval = TRUE; /* made it here, so success */
+    retval = TRUE; /* made it here, so success */
 
 done:
-        PL_strfree(siedn);
-	PL_strfree(userGroupLdapURL);
-	PL_strfree(userGroupBindDN);
-	PL_strfree(userGroupBindPW);
-	PL_strfree(dirInfoRef);
-	destroyAdmldap(info);
+    PL_strfree(siedn);
+    PL_strfree(userGroupLdapURL);
+    PL_strfree(userGroupBindDN);
+    if (userGroupBindPW) {
+        memset(userGroupBindPW, 0, strlen(userGroupBindPW));
+        PL_strfree(userGroupBindPW);
+    }
+    PL_strfree(dirInfoRef);
+    destroyAdmldap(info);
 
     return retval;
 }