From 306cd912b5b84c02ae9b786f72963506369df649 Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Tue, 13 Feb 2018 15:46:20 +0100 Subject: svl: clear temporary copies of passwords in SvlPasswordHelper This is an obvious place to start, but there might be more copies elsewhere. Change-Id: I3c3ea6cb54f40fe5c21c3128b55aeaad1ff74b42 Reviewed-on: https://gerrit.libreoffice.org/49669 Tested-by: Jenkins Reviewed-by: Michael Stahl --- svl/source/misc/PasswordHelper.cxx | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'svl/source/misc') diff --git a/svl/source/misc/PasswordHelper.cxx b/svl/source/misc/PasswordHelper.cxx index 48aa165507ee..4f8cbb655b08 100644 --- a/svl/source/misc/PasswordHelper.cxx +++ b/svl/source/misc/PasswordHelper.cxx @@ -33,6 +33,7 @@ void SvPasswordHelper::GetHashPasswordSHA256(uno::Sequence& rPassHash, ::comphelper::HashType::SHA256)); rPassHash.realloc(hash.size()); ::std::copy(hash.begin(), hash.end(), rPassHash.begin()); + rtl_secureZeroMemory(const_cast(tmp.getStr()), tmp.getLength()); } void SvPasswordHelper::GetHashPasswordSHA1UTF8(uno::Sequence& rPassHash, OUString const& rPassword) @@ -43,6 +44,7 @@ void SvPasswordHelper::GetHashPasswordSHA1UTF8(uno::Sequence& rPassHas ::comphelper::HashType::SHA1)); rPassHash.realloc(hash.size()); ::std::copy(hash.begin(), hash.end(), rPassHash.begin()); + rtl_secureZeroMemory(const_cast(tmp.getStr()), tmp.getLength()); } void SvPasswordHelper::GetHashPassword(uno::Sequence& rPassHash, const sal_Char* pPass, sal_uInt32 nLen) @@ -69,6 +71,7 @@ void SvPasswordHelper::GetHashPasswordLittleEndian(uno::Sequence& rPas } GetHashPassword(rPassHash, pCharBuffer.get(), nSize * sizeof(sal_Unicode)); + rtl_secureZeroMemory(pCharBuffer.get(), nSize * sizeof(sal_Unicode)); } void SvPasswordHelper::GetHashPasswordBigEndian(uno::Sequence& rPassHash, const OUString& sPass) @@ -84,6 +87,7 @@ void SvPasswordHelper::GetHashPasswordBigEndian(uno::Sequence& rPassHa } GetHashPassword(rPassHash, pCharBuffer.get(), nSize * sizeof(sal_Unicode)); + rtl_secureZeroMemory(pCharBuffer.get(), nSize * sizeof(sal_Unicode)); } void SvPasswordHelper::GetHashPassword(uno::Sequence& rPassHash, const OUString& sPass) -- cgit