Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

memory leak in Linux using credentials class for basic auth #1696

Open
jyanezt opened this issue Apr 3, 2022 · 0 comments
Open

memory leak in Linux using credentials class for basic auth #1696

jyanezt opened this issue Apr 3, 2022 · 0 comments

Comments

@jyanezt
Copy link

jyanezt commented Apr 3, 2022

Hi, I was trying web proxy basic auth in cpprestsdk for Ubuntu 20, and the leak sanitizer detected memory leaks. I think the problem comes from this function in web_utilities.h:

    details::plaintext_string _internal_decrypt() const
    {
        // Encryption APIs not supported on XP
#if defined(_WIN32) && _WIN32_WINNT >= _WIN32_WINNT_VISTA
        return m_password.decrypt();
#else
        return details::plaintext_string(new ::utility::string_t(m_password));
#endif
    }

In the line executed for Linux, that plaintext_string currently has this definition:

typedef std::unique_ptr<::utility::string_t, zero_memory_deleter> plaintext_string;

The problem is that the zero_memory_deleter, defined in web_utilities.cpp, isn't doing anything for Linux:

void zero_memory_deleter::operator()(::utility::string_t* data) const
{
    (void)data;
#ifdef _WIN32
    SecureZeroMemory(&(*data)[0], data->size() * sizeof(::utility::string_t::value_type));
    delete data;
#endif
}

So the string is leaked when the plaintext_string is deleted. Shouldn't the delete data part be outside the #ifdef _WIN32 ? Or maybe a different deleter should be used for Linux?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant