mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-30 06:46:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: clear auth credential buffers from stack after use

Browse source 
Information Disclosure: Medium

The RAOP authentication header construction leaves sensitive material
on the stack after the function returns: Base64-encoded credentials in
enc[], MD5 password-derived hashes in h1/h2/resp[], and the assembled
Authorization header in auth[]. These persist in stack memory and can
be recovered via core dumps, memory disclosure vulnerabilities, or
cold boot attacks.

The plaintext password buffer (buf[]) was already properly cleared with
explicit_bzero, but the derived credential buffers were not. Apply
explicit_bzero to enc, h1, h2, resp, and auth before returning.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-24 16:54:55 +02:00
parent c525cfcced
commit e2c7ed2d0c
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/modules/module-raop-sink.c
View file

@ -728,6 +728,7 @@ static int rtsp_add_raop_auth_header(struct impl *impl, const char *method)
pw_base64_encode((uint8_t*)buf, strlen(buf), enc, '='); pw_base64_encode((uint8_t*)buf, strlen(buf), enc, '=');
explicit_bzero(buf, sizeof(buf)); explicit_bzero(buf, sizeof(buf));
spa_scnprintf(auth, sizeof(auth), "Basic %s", enc); spa_scnprintf(auth, sizeof(auth), "Basic %s", enc);
explicit_bzero(enc, sizeof(enc));
} }
else if (spa_streq(impl->auth_method, "Digest")) { else if (spa_streq(impl->auth_method, "Digest")) {
const char *url; const char *url;
@ -744,12 +745,16 @@ static int rtsp_add_raop_auth_header(struct impl *impl, const char *method)
spa_scnprintf(auth, sizeof(auth), spa_scnprintf(auth, sizeof(auth),
"username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", response=\"%s\"", "username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", response=\"%s\"",
RAOP_AUTH_USER_NAME, impl->realm, impl->nonce, url, resp); RAOP_AUTH_USER_NAME, impl->realm, impl->nonce, url, resp);
explicit_bzero(h1, sizeof(h1));
explicit_bzero(h2, sizeof(h2));
explicit_bzero(resp, sizeof(resp));
} }
else else
goto error; goto error;
pw_properties_setf(impl->headers, "Authorization", "%s %s", pw_properties_setf(impl->headers, "Authorization", "%s %s",
impl->auth_method, auth); impl->auth_method, auth);
explicit_bzero(auth, sizeof(auth));
return 0; return 0;
error: error: