From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 19 May 2026 07:42:20 +0000 (+0200)
Subject: credentials: Clear the moved-from string before checking its capacity
X-Git-Tag: auth-5.1.0~37^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c182a283f9bc34b3388c58d0b9efe2fa471bb74f;p=thirdparty%2Fpdns.git

credentials: Clear the moved-from string before checking its capacity

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
---

diff --git a/pdns/credentials.cc b/pdns/credentials.cc
index 277e09e53f..c91873c205 100644
--- a/pdns/credentials.cc
+++ b/pdns/credentials.cc
@@ -84,11 +84,11 @@ void SensitiveData::reallyClearContent(void* data, size_t size) noexcept
 SensitiveData::SensitiveData(std::string&& data) :
   d_data(std::move(data))
 {
+  data.clear();
 #ifdef HAVE_LIBSODIUM
   // let's be nice and try to zero out the SSO buffer
   reallyClearContent(data.data(), data.capacity());
 #endif
-  data.clear();
 #ifdef HAVE_LIBSODIUM
   sodium_mlock(d_data.data(), d_data.size());
 #endif