cleanup: zero set strings before freeing thembagder/clear-free-strings

... to avoid having sensitive data lingering around in the heap after
use.

URL: https://curl.haxx.se/mail/lib-2018-03/0012.html

1 files changed, 3 insertions, 0 deletions

diff --git a/lib/url.c b/lib/url.c
index 945d4e327..542929365 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -278,6 +278,9 @@ void Curl_freeset(struct Curl_easy *data)
   /* Free all dynamic strings stored in the data->set substructure. */
   enum dupstring i;
   for(i = (enum dupstring)0; i < STRING_LAST; i++) {
+    if(data->set.str[i])
+      /* clear them before free to make sure no sensitive data linger around */
+      memset(data->set.str[i], 0, strlen(data->set.str[i]));
     Curl_safefree(data->set.str[i]);
   }