Release 3.3

[kerberos/krb5-strength.git] / plugin / principal.c

diff --git a/plugin/principal.c b/plugin/principal.c
index 88ead594d20861412c7ec808a63e855bd0981ce8..cd3b8b812b5bbafa33e248b2d4a902669ad9add9 100644 (file)
--- a/plugin/principal.c
+++ b/plugin/principal.c
@@ -5,13 +5,13 @@
  * password is being changed, trying to detect and reject passwords based on
  * components of the principal.
  *
- * Developed by Derrick Brashear and Ken Hornstein of Sine Nomine Associates,
- *     on behalf of Stanford University
- * Extensive modifications by Russ Allbery <rra@stanford.edu>
- * Copyright 2006, 2007, 2009, 2012, 2013
+ * Developed by Daria Phoebe Brashear and Ken Hornstein of Sine Nomine
+ * Associates, on behalf of Stanford University Extensive modifications by Russ
+ * Allbery <eagle@eyrie.org> Copyright 2020 Russ Allbery <eagle@eyrie.org>
+ * Copyright 2006-2007, 2009, 2012-2014
  *     The Board of Trustees of the Leland Stanford Junior University
  *
- * See LICENSE for licensing terms.
+ * SPDX-License-Identifier: MIT
  */
 
 #include <config.h>
@@ -56,6 +56,7 @@ check_component(krb5_context ctx, const char *component, const char *password)
             copy[j] = c;
         }
         if (strcasecmp(copy, password) == 0) {
+            explicit_bzero(copy, strlen(copy));
             free(copy);
             return strength_error_generic(ctx, ERROR_USERNAME);
         }
@@ -158,6 +159,7 @@ strength_check_principal(krb5_context ctx, krb5_pwqual_moddata data UNUSED,
         if (i != 0) {
             code = check_component(ctx, copy + i, password);
             if (code != 0) {
+                explicit_bzero(copy, strlen(copy));
                 free(copy);
                 return code;
             }
@@ -174,6 +176,7 @@ strength_check_principal(krb5_context ctx, krb5_pwqual_moddata data UNUSED,
         /* Check the current component. */
         code = check_component(ctx, start, password);
         if (code != 0) {
+            explicit_bzero(copy, strlen(copy));
             free(copy);
             return code;
         }
@@ -184,6 +187,7 @@ strength_check_principal(krb5_context ctx, krb5_pwqual_moddata data UNUSED,
     } while (i < length);
 
     /* Password does not appear to be based on the principal. */
+    explicit_bzero(copy, strlen(copy));
     free(copy);
     return 0;
 }