* Port [3485] to 1.2.14

 * Add OPENSSL_cleanse() to more places



svn: 3486

src/binary.c

@@ -351,6 +351,7 @@ static void edpack(settings_t *incfg, const char *in_hash, int what)
 
 #define update_hash()		do {				\
 	hash = MD5(nhash);					\
+	OPENSSL_cleanse(nhash, sizeof(nhash));			\
 	nhash[0] = 0;						\
 } while (0)
 

src/crypt.c

@@ -144,6 +144,7 @@ char *encrypt_pass(struct userrec *u, char *in)
   simple_snprintf(buf, sizeof(buf), "%s-%s", settings.salt2, in);
 
   tmp = encrypt_string(user_key(u), buf);
+  OPENSSL_cleanse(buf, sizeof(buf));
   ret_size = strlen(tmp) + 1 + 1;
   ret = (char *) my_calloc(1, ret_size);
 

src/main.c

@@ -229,6 +229,8 @@ static void checkpass()
     checkedpass = 1;
     if (!gpasswd || (gpasswd && md5cmp(settings.shellhash, gpasswd) && !check_master_hash(NULL, gpasswd))) 
       werr(ERR_BADPASS);
+    /* Most PASS_MAX are 256.. but it's not clear */
+    OPENSSL_cleanse(gpasswd, 30);
   }
 }
 

src/misc.c

@@ -1324,12 +1324,16 @@ bool check_master_hash(const char *rand, const char *hash)
 
   if (1) {
     if (rand && rand[0])
-      if (!strcmp(MD5(tmp), hash))
+      if (!strcmp(MD5(tmp), hash)) {
+        OPENSSL_cleanse(tmp, sizeof(tmp));
         return 1;
+      }
   }
 
-  if (!strcmp(tmp, MD5(hash)))
+  if (!strcmp(tmp, MD5(hash))) {
+    OPENSSL_cleanse(tmp, sizeof(tmp));
     return 1;
+  }
   return 0;
 }
 

src/userrec.c

@@ -522,6 +522,7 @@ int change_handle(struct userrec *u, char *newh)
   strlcpy(s, u->handle, sizeof s);
   strlcpy(u->handle, newh, sizeof u->handle);
   set_user(&USERENTRY_PASS, u, pass);
+  OPENSSL_cleanse(pass, strlen(pass));
   free(pass);
   for (int i = 0; i < dcc_total; i++)
     if (dcc[i].type && dcc[i].type != &DCC_BOT && !egg_strcasecmp(dcc[i].nick, s)) {