- dtucker@cvs.openbsd.org 2014/07/25 21:22:03
[ssh-agent.c]
Clear buffer used for handling messages. This prevents keys being
left in memory after they have been expired or deleted in some cases
(but note that ssh-agent is setgid so you would still need root to
access them). Pointed out by Kevin Burns, ok deraadt
diff --git a/ChangeLog b/ChangeLog
index 3a91bae..f6ed388 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,12 @@
- millert@cvs.openbsd.org 2014/07/24 22:57:10
[ssh.1]
Mention UNIX-domain socket forwarding too. OK jmc@ deraadt@
+ - dtucker@cvs.openbsd.org 2014/07/25 21:22:03
+ [ssh-agent.c]
+ Clear buffer used for handling messages. This prevents keys being
+ left in memory after they have been expired or deleted in some cases
+ (but note that ssh-agent is setgid so you would still need root to
+ access them). Pointed out by Kevin Burns, ok deraadt
20140725
- (djm) [regress/multiplex.sh] restore incorrectly deleted line;
diff --git a/ssh-agent.c b/ssh-agent.c
index e20a64e..25f10c5 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.189 2014/07/18 02:46:01 djm Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.190 2014/07/25 21:22:03 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -968,6 +968,7 @@
break;
}
buffer_append(&sockets[i].input, buf, len);
+ explicit_bzero(buf, sizeof(buf));
process_message(&sockets[i]);
}
break;