about summary refs log tree commit diff
diff options
context:
space:
mode:
authorJune McEnroe <june@causal.agency>2019-10-31 17:45:02 -0400
committerJune McEnroe <june@causal.agency>2019-10-31 17:45:02 -0400
commit750be17704654f93a16ef4fc36405ba3abb5f493 (patch)
treedd74df6cb3d2bd2cdc27245e800994cf720159c4
parentClean up cert path documentation (diff)
downloadpounce-750be17704654f93a16ef4fc36405ba3abb5f493.tar.gz
pounce-750be17704654f93a16ef4fc36405ba3abb5f493.zip
Clear passwords from memory with memset_s
-rw-r--r--bounce.c9
-rw-r--r--state.c3
2 files changed, 10 insertions, 2 deletions
diff --git a/bounce.c b/bounce.c
index aa1cecc..cc6b34f 100644
--- a/bounce.c
+++ b/bounce.c
@@ -14,6 +14,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#define __STDC_WANT_LIB_EXT1__ 1
+
 #include <assert.h>
 #include <err.h>
 #include <errno.h>
@@ -107,8 +109,8 @@ int main(int argc, char *argv[]) {
 	bool insecure = false;
 	const char *host = NULL;
 	const char *port = "6697";
-	const char *pass = NULL;
-	const char *auth = NULL;
+	char *pass = NULL;
+	char *auth = NULL;
 	const char *nick = NULL;
 	const char *user = NULL;
 	const char *real = NULL;
@@ -195,6 +197,9 @@ int main(int argc, char *argv[]) {
 
 	int server = serverConnect(insecure, host, port);
 	stateLogin(pass, auth, nick, user, real);
+	if (pass) memset_s(pass, strlen(pass), 0, strlen(pass));
+	if (auth) memset_s(auth, strlen(auth), 0, strlen(auth));
+
 	while (!stateReady()) serverRecv();
 	serverFormat("AWAY :%s\r\n", away);
 	if (join) serverFormat("JOIN :%s\r\n", join);
diff --git a/state.c b/state.c
index 50afb26..37df845 100644
--- a/state.c
+++ b/state.c
@@ -14,6 +14,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#define __STDC_WANT_LIB_EXT1__ 1
+
 #include <assert.h>
 #include <err.h>
 #include <stdbool.h>
@@ -99,6 +101,7 @@ static void handleAuthenticate(struct Message *msg) {
 	(void)msg;
 	if (!plainBase64) errx(EX_PROTOCOL, "unsolicited AUTHENTICATE");
 	serverFormat("AUTHENTICATE %s\r\n", plainBase64);
+	memset_s(plainBase64, strlen(plainBase64), 0, strlen(plainBase64));
 	free(plainBase64);
 	plainBase64 = NULL;
 }