mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-25 06:46:40 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: clear sensitive auth data from stack buffers in RAOP

Browse source 
Information Disclosure: Medium

The MD5_hash() function formats password material into a 1024-byte
stack buffer for hashing but never clears it afterward. Similarly,
the Basic auth path in rtsp_add_raop_auth_header() formats
username:password into a stack buffer without clearing it.

These buffers remain on the stack after the functions return, and
could be exposed through memory disclosure vulnerabilities, core
dumps, or memory inspection.

Clear the buffers with explicit_bzero() immediately after they are
no longer needed, consistent with the existing practice of clearing
the password before freeing in impl_destroy().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-23 17:18:04 +02:00
parent 2c78c1e1fb
commit cd00ea2462
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/modules/module-raop-sink.c
View file

@ -707,6 +707,7 @@ static int MD5_hash(char hash[MD5_HASH_LENGTH+1], const char *fmt, ...)
size = MD5_DIGEST_LENGTH; size = MD5_DIGEST_LENGTH;
EVP_Digest(buffer, strlen(buffer), d, &size, EVP_md5(), NULL); EVP_Digest(buffer, strlen(buffer), d, &size, EVP_md5(), NULL);
explicit_bzero(buffer, sizeof(buffer));
for (i = 0; i < MD5_DIGEST_LENGTH; i++) for (i = 0; i < MD5_DIGEST_LENGTH; i++)
snprintf(&hash[2*i], 3, "%02x", (uint8_t) d[i]); snprintf(&hash[2*i], 3, "%02x", (uint8_t) d[i]);
hash[MD5_HASH_LENGTH] = '\0'; hash[MD5_HASH_LENGTH] = '\0';
@ -725,6 +726,7 @@ static int rtsp_add_raop_auth_header(struct impl *impl, const char *method)
char enc[512]; char enc[512];
spa_scnprintf(buf, sizeof(buf), "%s:%s", RAOP_AUTH_USER_NAME, impl->password); spa_scnprintf(buf, sizeof(buf), "%s:%s", RAOP_AUTH_USER_NAME, impl->password);
pw_base64_encode((uint8_t*)buf, strlen(buf), enc, '='); pw_base64_encode((uint8_t*)buf, strlen(buf), enc, '=');
explicit_bzero(buf, sizeof(buf));
spa_scnprintf(auth, sizeof(auth), "Basic %s", enc); spa_scnprintf(auth, sizeof(auth), "Basic %s", enc);
} }
else if (spa_streq(impl->auth_method, "Digest")) { else if (spa_streq(impl->auth_method, "Digest")) {