From: | Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com> |
---|---|
To: | Daniel Gustafsson <daniel(at)yesql(dot)se> |
Cc: | Peter Eisentraut <peter(at)eisentraut(dot)org>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>, Antonin Houska <ah(at)cybertec(dot)at> |
Subject: | Re: [PoC] Federated Authn/z with OAUTHBEARER |
Date: | 2024-10-24 22:28:01 |
Message-ID: | CAOYmi+m4zFdp+cgMfUjZR9mfZC5rfraHR2Pfo4XZU0oZ-6+YYw@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Fri, Oct 18, 2024 at 4:38 AM Daniel Gustafsson <daniel(at)yesql(dot)se> wrote:
> In validate() it seems to me we should clear out ret->authn_id on failure to
> pair belts with suspenders. Fixed by calling explicit_bzero on it in the error
> path.
The new hunk says:
> cleanup:
> /*
> * Clear and free the validation result from the validator module once
> * we're done with it to avoid accidental re-use.
> */
> if (ret->authn_id != NULL)
> {
> explicit_bzero(ret->authn_id, strlen(ret->authn_id));
> pfree(ret->authn_id);
> }
> pfree(ret);
But I'm not clear on what's being protected against. Which code would
reuse this result?
Thanks,
--Jacob
From | Date | Subject | |
---|---|---|---|
Next Message | Michael Paquier | 2024-10-24 22:28:25 | Re: Retire support for OpenSSL 1.1.1 due to raised API requirements |
Previous Message | Rahila Syed | 2024-10-24 21:55:10 | Re: Using read_stream in index vacuum |