Merge pull request #1519 from ggreer/clear-password-buffer-0.15

Swaylock: Clear password buffer after use.

1 files changed, 25 insertions, 30 deletions

diff --git a/swaylock/main.c b/swaylock/main.c
index 1ed28c2b..4b486461 100644
--- a/swaylock/main.c
+++ b/swaylock/main.c
@@ -7,6 +7,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/mman.h>
 #include <sys/types.h>
 #include <pwd.h>
 #include <getopt.h>
@@ -56,8 +57,7 @@ void sway_terminate(int exit_code) {
 	exit(exit_code);
 }
 
-char *password;
-int password_size;
+char password[1024];
 enum line_source line_source = LINE_SOURCE_DEFAULT;
 
 struct lock_config *init_config() {
@@ -115,7 +115,7 @@ int function_conversation(int num_msg, const struct pam_message **msg,
 		switch (msg[i]->msg_style) {
 		case PAM_PROMPT_ECHO_OFF:
 		case PAM_PROMPT_ECHO_ON:
-			pam_reply[i].resp = password;
+			pam_reply[i].resp = strdup(password); // PAM clears and frees this
 			break;
 
 		case PAM_ERROR_MSG:
@@ -127,9 +127,15 @@ int function_conversation(int num_msg, const struct pam_message **msg,
 	return PAM_SUCCESS;
 }
 
-/**
- * Note: PAM will free() 'password' during the process
- */
+void clear_password_buffer() {
+	// Use volatile keyword so so compiler can't optimize this out.
+	volatile char *pw = password;
+	volatile char zero = '\0';
+	for (size_t i = 0; i < sizeof(password); ++i) {
+		pw[i] = zero;
+	}
+}
+
 bool verify_password() {
 	struct passwd *passwd = getpwuid(getuid());
 	char *username = passwd->pw_name;
@@ -151,8 +157,7 @@ bool verify_password() {
 
 void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t code, uint32_t codepoint) {
 	int redraw_screen = 0;
-	char *password_realloc;
-	int i;
+	size_t i;
 
 	if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
 		switch (sym) {
@@ -165,14 +170,14 @@ void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t cod
 			wl_dispatch_events();
 
 			if (verify_password()) {
+				clear_password_buffer();
 				exit(0);
 			}
 
 			render_data.auth_state = AUTH_STATE_INVALID;
 			redraw_screen = 1;
 
-			password_size = 1024;
-			password = malloc(password_size);
+			clear_password_buffer();
 			password[0] = '\0';
 			break;
 		case XKB_KEY_BackSpace:
@@ -207,9 +212,7 @@ void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t cod
 				render_data.auth_state = AUTH_STATE_BACKSPACE;
 				redraw_screen = 1;
 
-				password_size = 1024;
-				free(password);
-				password = malloc(password_size);
+				clear_password_buffer();
 				password[0] = '\0';
 				break;
 			}
@@ -218,22 +221,10 @@ void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t cod
 			render_data.auth_state = AUTH_STATE_INPUT;
 			redraw_screen = 1;
 			i = strlen(password);
-			if (i + 1 == password_size) {
-				password_size += 1024;
-				password_realloc = realloc(password, password_size);
-				// reset password if realloc fails.
-				if (password_realloc == NULL) {
-					password_size = 1024;
-					free(password);
-					password = malloc(password_size);
-					password[0] = '\0';
-					break;
-				} else {
-					password = password_realloc;
-				}
+			if (i + 1 < sizeof(password)) {
+				password[i] = (char)codepoint;
+				password[i + 1] = '\0';
 			}
-			password[i] = (char)codepoint;
-			password[i + 1] = '\0';
 			break;
 		}
 		if (redraw_screen) {
@@ -539,8 +530,12 @@ int main(int argc, char **argv) {
 		sway_abort("Unsupported scaling mode: %s", scaling_mode_str);
 	}
 
-	password_size = 1024;
-	password = malloc(password_size);
+#ifdef __linux__
+	// Most non-linux platforms require root to mlock()
+	if (mlock(password, sizeof(password)) != 0) {
+		sway_abort("Unable to mlock() password memory.");
+	}
+#endif
 	password[0] = '\0';
 	render_data.surfaces = create_list();
 	if (!socket_path) {