Use zap() more consistently

Use zap() or zapfree() in places where we previously used memset() to
scrub memory.  Reported by Zhaomo Yang and Brian Johannesmeyer.

(back ported from commit d58cfa06bab766cf1354bc593deea300388072c0)

ticket: 8514
version_fixed: 1.14.5

diff --git a/src/kadmin/dbutil/kdb5_create.c b/src/kadmin/dbutil/kdb5_create.c
index 3698d57193c5f974266095793917e8dccd606c2f..6d91af3668a9d276aa1cd4e0c96e38fd1b6d5335 100644 (file)
--- a/src/kadmin/dbutil/kdb5_create.c
+++ b/src/kadmin/dbutil/kdb5_create.c
@@ -350,12 +350,8 @@ void kdb5_create(argc, argv)
     }
     /* clean up */
     (void) krb5_db_fini(util_context);
-    memset(master_keyblock.contents, 0, master_keyblock.length);
-    free(master_keyblock.contents);
-    if (pw_str) {
-        memset(pw_str, 0, pw_size);
-        free(pw_str);
-    }
+    zapfree(master_keyblock.contents, master_keyblock.length);
+    zapfree(pw_str, pw_size);
     free(master_salt.data);
 
     if (kadm5_create(&global_params)) {

diff --git a/src/kdc/main.c b/src/kdc/main.c
index 82dfc0e8631580ce076e36838a3da88718808fbf..0bbe33ac8206d3e5eeeaf8f05492da3702b1aaab 100644 (file)
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -168,8 +168,7 @@ finish_realm(kdc_realm_t *rdp)
             krb5_free_principal(rdp->realm_context, rdp->realm_tgsprinc);
         krb5_free_context(rdp->realm_context);
     }
-    memset(rdp, 0, sizeof(*rdp));
-    free(rdp);
+    zapfree(rdp, sizeof(*rdp));
 }
 
 /* Set *val_out to an allocated string containing val1 and/or val2, separated

diff --git a/src/lib/crypto/builtin/enc_provider/rc4.c b/src/lib/crypto/builtin/enc_provider/rc4.c
index 6fca98b4ff7b26f0e4ee0a8ed5f39c79659f17d3..3776f80715abb5d4f8e2f92154437ed08f736cc7 100644 (file)
--- a/src/lib/crypto/builtin/enc_provider/rc4.c
+++ b/src/lib/crypto/builtin/enc_provider/rc4.c
@@ -144,10 +144,8 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
                              (const unsigned char *)iov->data.data, iov->data.length);
     }
 
-    if (state == NULL) {
-        memset(arcfour_ctx, 0, sizeof(ArcfourContext));
-        free(arcfour_ctx);
-    }
+    if (state == NULL)
+        zapfree(arcfour_ctx, sizeof(ArcfourContext));
 
     return 0;
 }

diff --git a/src/lib/gssapi/krb5/delete_sec_context.c b/src/lib/gssapi/krb5/delete_sec_context.c
index 89228ca782842a83c6cd8e766c0a9131ab06216d..4b9dfae0d515bb456212e3db9be6e7dc63ebc11b 100644 (file)
--- a/src/lib/gssapi/krb5/delete_sec_context.c
+++ b/src/lib/gssapi/krb5/delete_sec_context.c
@@ -87,7 +87,7 @@ krb5_gss_delete_sec_context(minor_status, context_handle, output_token)
         krb5_free_context(ctx->k5_context);
 
     /* Zero out context */
-    memset(ctx, 0, sizeof(*ctx));
+    zap(ctx, sizeof(*ctx));
     xfree(ctx);
 
     /* zero the handle itself */

diff --git a/src/lib/gssapi/krb5/export_sec_context.c b/src/lib/gssapi/krb5/export_sec_context.c
index 1b3de6818867808218236666b5f1f6c63f3f8e62..49bd76d2bc2192dbf7fd5efa6e6cca0025d55f4d 100644 (file)
--- a/src/lib/gssapi/krb5/export_sec_context.c
+++ b/src/lib/gssapi/krb5/export_sec_context.c
@@ -91,7 +91,7 @@ error_out:
         if (kret != 0 && context != 0)
             save_error_info((OM_uint32)kret, context);
     if (obuffer && bufsize) {
-        memset(obuffer, 0, bufsize);
+        zap(obuffer, bufsize);
         xfree(obuffer);
     }
     if (*minor_status == 0)

diff --git a/src/lib/gssapi/krb5/lucid_context.c b/src/lib/gssapi/krb5/lucid_context.c
index 449e71fed4c71813ab15fe2442ddefc91b1cc78e..a894f0e7355cb81ed6ddb021226f363d4178a7d6 100644 (file)
--- a/src/lib/gssapi/krb5/lucid_context.c
+++ b/src/lib/gssapi/krb5/lucid_context.c
@@ -266,9 +266,9 @@ free_lucid_key_data(
 {
     if (key) {
         if (key->data && key->length) {
-            memset(key->data, 0, key->length);
+            zap(key->data, key->length);
             xfree(key->data);
-            memset(key, 0, sizeof(gss_krb5_lucid_key_t));
+            zap(key, sizeof(gss_krb5_lucid_key_t));
         }
     }
 }

diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
index b7e8a8daf8c9c04f6b15fbed452277de3f75f6db..42299eb3a618f9f9422ec9592d6abcc47f57e5ab 100644 (file)
--- a/src/lib/gssapi/mechglue/g_initialize.c
+++ b/src/lib/gssapi/mechglue/g_initialize.c
@@ -513,10 +513,8 @@ releaseMechInfo(gss_mech_info *pCf)
        if (cf->mech_type != GSS_C_NO_OID &&
            cf->mech_type != &cf->mech->mech_type)
                generic_gss_release_oid(&minor_status, &cf->mech_type);
-       if (cf->mech != NULL && cf->freeMech) {
-               memset(cf->mech, 0, sizeof(*cf->mech));
-               free(cf->mech);
-       }
+       if (cf->freeMech)
+               zapfree(cf->mech, sizeof(*cf->mech));
        if (cf->dl_handle != NULL)
                krb5int_close_plugin(cf->dl_handle);
        if (cf->int_mech_type != GSS_C_NO_OID)

diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
index 1d4365c836fb43c3979f0292460e077f480335fa..87b8c23e07f49e2075fa3d19e2d9b51ed29cc945 100644 (file)
--- a/src/lib/kadm5/srv/svr_principal.c
+++ b/src/lib/kadm5/srv/svr_principal.c
@@ -122,13 +122,8 @@ kadm5_ret_t krb5_copy_key_data_contents(context, from, to)
         if ( from->key_data_length[i] ) {
             to->key_data_contents[i] = malloc(from->key_data_length[i]);
             if (to->key_data_contents[i] == NULL) {
-                for (i = 0; i < idx; i++) {
-                    if (to->key_data_contents[i]) {
-                        memset(to->key_data_contents[i], 0,
-                               to->key_data_length[i]);
-                        free(to->key_data_contents[i]);
-                    }
-                }
+                for (i = 0; i < idx; i++)
+                    zapfree(to->key_data_contents[i], to->key_data_length[i]);
                 return ENOMEM;
             }
             memcpy(to->key_data_contents[i], from->key_data_contents[i],

diff --git a/src/lib/krb5/krb/authdata.c b/src/lib/krb5/krb/authdata.c
index fb8beb3cfdb814927b36686e19ce9022e0527e2b..b4cbefe52b2b246ab1b0fd269c7fcb59b12e98fc 100644 (file)
--- a/src/lib/krb5/krb/authdata.c
+++ b/src/lib/krb5/krb/authdata.c
@@ -479,8 +479,7 @@ krb5_authdata_context_free(krb5_context kcontext,
         context->modules = NULL;
     }
     krb5int_close_plugin_dirs(&context->plugins);
-    memset(context, 0, sizeof(*context));
-    free(context);
+    zapfree(context, sizeof(*context));
 }
 
 krb5_error_code KRB5_CALLCONV

diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c
index 2458695b1c64c4064f900ddf72324f135323f125..82c112eacd5fb8a75b7ff435bcff09e2c51892c9 100644 (file)
--- a/src/lib/krb5/krb/pac.c
+++ b/src/lib/krb5/krb/pac.c
@@ -125,14 +125,9 @@ krb5_pac_free(krb5_context context,
               krb5_pac pac)
 {
     if (pac != NULL) {
-        if (pac->data.data != NULL) {
-            memset(pac->data.data, 0, pac->data.length);
-            free(pac->data.data);
-        }
-        if (pac->pac != NULL)
-            free(pac->pac);
-        memset(pac, 0, sizeof(*pac));
-        free(pac);
+        zapfree(pac->data.data, pac->data.length);
+        free(pac->pac);
+        zapfree(pac, sizeof(*pac));
     }
 }