From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 27 Jul 2023 22:27:38 +0000 (-0700)
Subject: securely wipe secret information in pairs
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d8ddfd4a1df33cfa21b942b20ce53af263b93c52;p=thirdparty%2Ffreeradius-server.git

securely wipe secret information in pairs
---

diff --git a/src/include/build.h b/src/include/build.h
index ec00bbc4818..98a04de5639 100644
--- a/src/include/build.h
+++ b/src/include/build.h
@@ -77,6 +77,8 @@ extern "C" {
  */
 #include <stdint.h>
 #include <stddef.h>
+
+#define __STDC_WANT_LIB_EXT1__ 1
 #include <string.h>
 
 /*
diff --git a/src/lib/util/pair.c b/src/lib/util/pair.c
index 2c52255ecc1..66b870258f0 100644
--- a/src/lib/util/pair.c
+++ b/src/lib/util/pair.c
@@ -87,7 +87,13 @@ static int _fr_pair_free(fr_pair_t *vp)
 		fr_pair_list_free(&vp->vp_group);
 		break;
 
+	case FR_TYPE_STRING:
+	case FR_TYPE_OCTETS:
+		if (vp->data.secret) (void) memset_s(vp->vp_ptr, vp->vp_length, 0, vp->vp_length);
+		break;
+
 	default:
+		if (vp->data.secret) (void) memset_s(&vp->data, sizeof(vp->data), 0, sizeof(vp->data));
 		break;
 	}
 
diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index 8ff187ea9f7..bfb4631685d 100644
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -3525,6 +3525,7 @@ void fr_value_box_clear_value(fr_value_box_t *data)
 	switch (data->type) {
 	case FR_TYPE_OCTETS:
 	case FR_TYPE_STRING:
+		if (data->secret) (void) memset_s(data->datum.ptr, data->vb_length, 0, data->vb_length);
 		talloc_free(data->datum.ptr);
 		break;