Changeset 93392 in vbox for trunk

Timestamp:

Jan 21, 2022 11:07:13 AM (3 years ago)

Author:

vboxsync

Message:

VMM/CFGM: Must thoroughly wipe password memory before freeing it. bugref:9469

Location:

trunk/src/VBox/VMM

Files:

trunk/src/VBox/VMM/VMMR3/CFGM.cpp

-              r93115
+              r93392
                 break;
+            case CFGMVALUETYPE_PASSWORD:
+                RTMemWipeThoroughly(pLeaf->Value.String.psz, pLeaf->Value.String.cb, 10);
+                RT_FALL_THROUGH();
             case CFGMVALUETYPE_STRING:
-            case CFGMVALUETYPE_PASSWORD:
                 cfgmR3StrFree(pVM, pLeaf->Value.String.psz);
                 pLeaf->Value.String.psz = NULL;
 …
+            }
             else
+            {
+                RTMemWipeThoroughly(pszStringCopy, cchString, 10);
                 cfgmR3StrFree(pNode->pVM, pszStringCopy);
+            }
+        }
         else

r93115	r93392
44	44	} Integer;
45	45
46		/** String value. (UTF-8 of course) */
	46	/** String or password value. (UTF-8 of course) */
47	47	struct CFGMVALUE_STRING
48	48	{

Note: See TracChangeset for help on using the changeset viewer.