shared: improve nm_free_secret() to clear entire memory buffer

The purpose is to clear the entire available buffer, not only
up to the first '\0'. This is done, because otherwise we might
leak sensitive data that happens to be after the first '\0',
or we might give away the length of the secrets.

Of course, those are very (very) minor concerns. But avoiding them is
easy enough.

2 files changed, 27 insertions, 8 deletions

diff --git a/shared/nm-glib-aux/nm-secret-utils.c b/shared/nm-glib-aux/nm-secret-utils.c
index 5b0afe4694..282511d10d 100644
--- a/shared/nm-glib-aux/nm-secret-utils.c
+++ b/shared/nm-glib-aux/nm-secret-utils.c
@@ -8,6 +8,8 @@
 
 #include "nm-secret-utils.h"
 
+#include <malloc.h>
+
 /*****************************************************************************/
 
 void
@@ -32,6 +34,30 @@ nm_explicit_bzero (void *s, gsize n)
 #endif
 }
 
+void
+nm_free_secret (char *secret)
+{
+	gsize len;
+
+	if (!secret)
+		return;
+
+#if GLIB_CHECK_VERSION(2,44,0)
+	/* Here we mix malloc() and g_malloc() API. Usually we avoid this,
+	 * however since glib 2.44.0 we are in fact guaranteed that g_malloc()/g_free()
+	 * just wraps malloc()/free(), so this is actually fine.
+	 *
+	 * See https://gitlab.gnome.org/GNOME/glib/commit/3be6ed60aa58095691bd697344765e715a327fc1
+	 */
+	len = malloc_usable_size (secret);
+#else
+	len = strlen (secret);
+#endif
+
+	nm_explicit_bzero (secret, len);
+	g_free (secret);
+}
+
 /*****************************************************************************/
 
 char *
diff --git a/shared/nm-glib-aux/nm-secret-utils.h b/shared/nm-glib-aux/nm-secret-utils.h
index 1b98b7e9ef..17d5e85301 100644
--- a/shared/nm-glib-aux/nm-secret-utils.h
+++ b/shared/nm-glib-aux/nm-secret-utils.h
@@ -18,14 +18,7 @@ char *nm_secret_strchomp (char *secret);
 
 /*****************************************************************************/
 
-static inline void
-nm_free_secret (char *secret)
-{
-	if (secret) {
-		nm_explicit_bzero (secret, strlen (secret));
-		g_free (secret);
-	}
-}
+void nm_free_secret (char *secret);
 
 NM_AUTO_DEFINE_FCN0 (char *, _nm_auto_free_secret, nm_free_secret)
 /**