diff options
| author | George Wang <gwang@php.net> | 2015-12-08 23:43:29 -0500 |
|---|---|---|
| committer | George Wang <gwang@php.net> | 2015-12-09 00:26:24 -0500 |
| commit | c60d4b97707c513ee8b554eecf1c5c653cae5998 (patch) | |
| tree | cd489ee251c88e7e0cf7ac318eb46e5ca3d278ba | |
| parent | 84fd8ffa2ab213ce6bd2981c45e76e6e43db3604 (diff) | |
| download | php-git-c60d4b97707c513ee8b554eecf1c5c653cae5998.tar.gz | |
Clear secret after use.
| -rw-r--r-- | sapi/litespeed/lsapilib.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/sapi/litespeed/lsapilib.c b/sapi/litespeed/lsapilib.c index 02a7068276..eb82dd868f 100644 --- a/sapi/litespeed/lsapilib.c +++ b/sapi/litespeed/lsapilib.c @@ -128,7 +128,7 @@ static int s_pid_dump_debug_info = 0; LSAPI_Request g_req = { -1, -1 }; -static char s_pSecret[24]; +static char s_secret[24]; void Flush_RespBuf_r( LSAPI_Request * pReq ); @@ -670,7 +670,7 @@ static int readSecret( const char * pSecretFile ) close( fd ); return -1; } - if ( read( fd, s_pSecret, 16 ) < 16 ) + if ( read( fd, s_secret, 16 ) < 16 ) { fprintf( stderr, "LSAPI: failed to read secret from secret file: %s\n", pSecretFile ); close( fd ); @@ -682,7 +682,7 @@ static int readSecret( const char * pSecretFile ) int LSAPI_is_suEXEC_Daemon() { - if (( !s_uid )&&( s_pSecret[0] )) + if (( !s_uid )&&( s_secret[0] )) return 1; else return 0; @@ -877,7 +877,7 @@ static int lsapi_suexec_auth( LSAPI_Request *pReq, if ( len < 32 ) return -1; memmove( achMD5, pAuth + 16, 16 ); - memmove( pAuth + 16, s_pSecret, 16 ); + memmove( pAuth + 16, s_secret, 16 ); lsapi_MD5Init( &md5ctx ); lsapi_MD5Update( &md5ctx, (unsigned char *)pAuth, 32 ); lsapi_MD5Update( &md5ctx, (unsigned char *)pUgid, 8 ); @@ -1170,8 +1170,11 @@ static int readReq( LSAPI_Request * pReq ) pReq->m_reqState = LSAPI_ST_REQ_BODY | LSAPI_ST_RESP_HEADER; if ( !s_uid ) + { if ( lsapi_changeUGid( pReq ) ) return -1; + memset(s_secret, 0, sizeof(s_secret)); + } pReq->m_bufProcessed = packetLen; //OPTIMIZATION @@ -1191,7 +1194,7 @@ int LSAPI_Init(void) if ( !g_inited ) { s_uid = geteuid(); - s_pSecret[0] = 0; + s_secret[0] = 0; lsapi_signal(SIGPIPE, lsapi_sigpipe); lsapi_signal(SIGUSR1, lsapi_siguser1); |