[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAKpyPV-pT1d3ysnUVJ7rWufZMv8t7mFdZu1xnST0grO=GoH31Q@mail.gmail.com>
Date: Wed, 25 Aug 2021 17:11:43 -0300
From: "Jean D'Elboux" <j@....com.br>
To: oss-security@...ts.openwall.com
Subject: Re: Possible memory leak on getspnam / getspnam_r
Thanks for your email Travis.
> Alternatively, a new function cleanup_and_zeroize_caches() could added. A
> user
> could call this after fork().
>
Yes, I've suggested something similar as an alternative (please check NB at
the end of my email).
> Of course, introducing a new function complicates the APIs and requires
> developers to add them. Also, to support multiple versions of libraries,
> developers would need to protect the call with an '#ifdef
> SUPPORTS_NEW_FUNCTION'.
>
In order to avoid more complexity to the API, instead of creating a new
function, endspent() could be bzero() internal buffer, since the user is
expressing he/she is done processing when calling it.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
