On Fri, Oct 18, 2024 at 4:38 AM Daniel Gustafsson <dan...@yesql.se> wrote:
> In validate() it seems to me we should clear out ret->authn_id on failure to
> pair belts with suspenders. Fixed by calling explicit_bzero on it in the error
> path.
The new hunk says:
> cleanup:
> /*
> * Clear and free the validation result from the validator module once
> * we're done with it to avoid accidental re-use.
> */
> if (ret->authn_id != NULL)
> {
> explicit_bzero(ret->authn_id, strlen(ret->authn_id));
> pfree(ret->authn_id);
> }
> pfree(ret);
But I'm not clear on what's being protected against. Which code would
reuse this result?
Thanks,
--Jacob
