[openssh-commits] [openssh] 01/87: upstream: clear PIN when deallocating; from Tess Gauthier via bz4047

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 2427bf51e812c5aa8bc2243edff9c98df2c01c40
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Thu Oct 29 22:53:23 2026 +0000

    upstream: clear PIN when deallocating; from Tess Gauthier via bz4047
    
    OpenBSD-Commit-ID: 1e1b4bc23ad923ac3c11adc266cfe4b9e7c53957
---
 ssh-add.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/ssh-add.c b/ssh-add.c
index 515272a35..9e10f404f 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.191 2026/09/17 18:12:10 dtucker Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.192 2026/10/29 22:53:23 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -488,7 +488,8 @@ update_card(int agent_fd, int add, const char *id, int qflag, int no_pin,
 		    add ? "add" : "remove", id, ssh_err(r));
 		ret = -1;
 	}
-	free(pin);
+	if (pin != NULL)
+		freezero(pin, strlen(pin));
 	return ret;
 }
 
@@ -614,7 +615,8 @@ load_resident_keys(int agent_fd, const char *skprovider, int qflag, int no_pin,
 		free(pin);
 		return r;
 	}
-	free(pin);
+	if (pin != NULL)
+		freezero(pin, strlen(pin));
 	for (i = 0; i < nsrks; i++) {
 		key = srks[i]->key;
 		if ((fp = sshkey_fingerprint(key,

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.