From: | Heikki Linnakangas <heikki(at)enterprisedb(dot)com> |
---|---|
To: | Pavan Deolasee <pavan(dot)deolasee(at)gmail(dot)com> |
Cc: | Bruce Momjian <bruce(at)momjian(dot)us>, Gregory Stark <stark(at)enterprisedb(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, David Fetter <david(at)fetter(dot)org>, Jim Nasby <decibel(at)decibel(dot)org>, pgsql-patches <pgsql-patches(at)postgresql(dot)org> |
Subject: | Re: Concurrent psql patch |
Date: | 2007-05-18 12:11:52 |
Message-ID: | 464D9808.5000701@enterprisedb.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers pgsql-patches |
Pavan Deolasee wrote:
> --- 1179,1189 ----
> dbname, user, password);
>
> /* We can immediately discard the password -- no longer needed */
> ! if (password)
> ! {
> ! memset(password, '\0', strlen(password));
> free(password);
> + }
>
>
> Any reason why we do this ? "password" is anyways freed. I think you
> might have left it behind after some debugging exercise.
I believe it's for security reasons. If that memory page is for example
swapped to disk after freeing the field, the password would be written
to the swapfile. Someone who steals your laptop would be able to recover
it from there. Clearing passwords from memory when they're no longer
needed is a good practice.
--
Heikki Linnakangas
EnterpriseDB http://www.enterprisedb.com
From | Date | Subject | |
---|---|---|---|
Next Message | Alvaro Herrera | 2007-05-18 13:12:18 | Re: Reducing stats collection overhead |
Previous Message | Heikki Linnakangas | 2007-05-18 12:06:46 | Re: Maintaining cluster order on insert |
From | Date | Subject | |
---|---|---|---|
Next Message | Pavel Stehule | 2007-05-18 13:02:01 | Re: Updateable cursors patch |
Previous Message | Heikki Linnakangas | 2007-05-18 12:06:46 | Re: Maintaining cluster order on insert |