search

trilogy-libraries / trilogy

Trilogy is a client library for MySQL-compatible database servers, designed for performance, flexibility, and ease of embedding.
MIT License
697 stars 68 forks source link

Clear password without memset #182

Closed ngan closed 3 months ago

ngan commented 4 months ago

Fixes https://github.com/trilogy-libraries/trilogy/issues/103 Closes https://github.com/trilogy-libraries/trilogy/pull/106

Instead of using memset() to clear the password, clear the password byte by byte in a loop. Additionally, we mark the char* as volatile to ensure that the compiler does not optimize away the memory access or the clearing operation.

ngan commented 3 months ago

I talked to @composerinteralia about this at RailsConf and we were unsure why the password is cleared at all. It's still available in Ruby, so why bother clearing it in C? We need the password to stick around since it's needed/used for reconnecting, etc.