summaryrefslogtreecommitdiff
path: root/src/basic
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2015-11-01 20:28:55 +0100
committerLennart Poettering <lennart@poettering.net>2015-11-02 23:07:20 +0100
commit9fe4ea21bec739bfe0ebac5565f0539b0e25b317 (patch)
tree4147053da096c3dacbef1a976b29c9add5c39c95 /src/basic
parent5732a7dbb0efa79cc36c6864a4af2e98685b53d6 (diff)
string-util: rework memory_erase() so that it cannot be optimized away
memory_erase() so far just called memset(), which the compiler might optimize away under certain conditions if it feels there's benefit in it. C11 knows a new memset_s() call that is like memset(), but may not be optimized away. Ideally, we'd just use that call, but glibc currently does not support it. Hence, implement our own simplistic version of it. We use a GCC pragma to turn off optimization for this call, and also use the "volatile" keyword on the pointers to ensure that gcc will use the pointers as-is. According to a variety of internet sources, either one does the trick. However, there are also reports that at least the volatile thing isn't fully correct, hence let's add some snake oil and employ both techniques. https://news.ycombinator.com/item?id=4711346
Diffstat (limited to 'src/basic')
-rw-r--r--src/basic/string-util.c31
-rw-r--r--src/basic/string-util.h4
2 files changed, 25 insertions, 10 deletions
diff --git a/src/basic/string-util.c b/src/basic/string-util.c
index 63b9b79df9..c3be576816 100644
--- a/src/basic/string-util.c
+++ b/src/basic/string-util.c
@@ -748,23 +748,38 @@ int free_and_strdup(char **p, const char *s) {
return 1;
}
-void string_erase(char *x) {
+#pragma GCC push_options
+#pragma GCC optimize("O0")
+
+void* memory_erase(void *p, size_t l) {
+ volatile uint8_t* x = (volatile uint8_t*) p;
+
+ /* This basically does what memset() does, but hopefully isn't
+ * optimized away by the compiler. One of those days, when
+ * glibc learns memset_s() we should replace this call by
+ * memset_s(), but until then this has to do. */
+
+ for (; l > 0; l--)
+ *(x++) = 'x';
+
+ return p;
+}
+
+#pragma GCC pop_options
+
+char* string_erase(char *x) {
if (!x)
- return;
+ return NULL;
/* A delicious drop of snake-oil! To be called on memory where
* we stored passphrases or so, after we used them. */
- memory_erase(x, strlen(x));
+ return memory_erase(x, strlen(x));
}
char *string_free_erase(char *s) {
- if (!s)
- return NULL;
-
- string_erase(s);
- return mfree(s);
+ return mfree(string_erase(s));
}
bool string_is_safe(const char *p) {
diff --git a/src/basic/string-util.h b/src/basic/string-util.h
index 297b8f8232..15244b8184 100644
--- a/src/basic/string-util.h
+++ b/src/basic/string-util.h
@@ -162,8 +162,8 @@ static inline void *memmem_safe(const void *haystack, size_t haystacklen, const
return memmem(haystack, haystacklen, needle, needlelen);
}
-#define memory_erase(p, l) memset((p), 'x', (l))
-void string_erase(char *x);
+void* memory_erase(void *p, size_t l);
+char *string_erase(char *x);
char *string_free_erase(char *s);
DEFINE_TRIVIAL_CLEANUP_FUNC(char *, string_free_erase);