glib-aux: drop usage of malloc_usable_size() in nm_free_secret()

The idea of nm_free_secret() is to clear the secrets from memory. That
surely is some layer of extra snake oil, because we tend to pass secrets
via D-Bus, where the memory gets passed down to (D-Bus) libraries which
have no idea to keep it private. Still...

But turns out, malloc_usable_size() might not actually be usable for
this. Read the discussion at [1].

Stop using malloc_usable_size(), which seems unfortunate.

There is probably no secret relevant data after the NUL byte anyway,
because we tend to create such strings once, and don't rewrite/truncate
them afterwards (which would leave secrets behind as garbage).

Note that systemd's erase_and_free() still uses malloc_usable_size()
([2]) but the macro foo to get that right is terrifying ([3]).

[1] https://github.com/systemd/systemd/issues/22801#issuecomment-1343041481
[2] 11c0f0659e/src/basic/memory-util.h (L101)
[3] 7929e180aa

Fixes: d63cd26e60 ('shared: improve nm_free_secret() to clear entire memory buffer')
This commit is contained in:
Thomas Haller
2023-02-08 12:15:41 +01:00
parent df228a5f8d
commit 8b66865a88

View File

@@ -39,24 +39,10 @@ nm_explicit_bzero(void *s, gsize n)
void void
nm_free_secret(char *secret) nm_free_secret(char *secret)
{ {
gsize len;
if (!secret) if (!secret)
return; return;
#if GLIB_CHECK_VERSION(2, 44, 0) nm_explicit_bzero(secret, strlen(secret));
/* Here we mix malloc() and g_malloc() API. Usually we avoid this,
* however since glib 2.44.0 we are in fact guaranteed that g_malloc()/g_free()
* just wraps malloc()/free(), so this is actually fine.
*
* See https://gitlab.gnome.org/GNOME/glib/commit/3be6ed60aa58095691bd697344765e715a327fc1
*/
len = malloc_usable_size(secret);
#else
len = strlen(secret);
#endif
nm_explicit_bzero(secret, len);
g_free(secret); g_free(secret);
} }