summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatt Johnston <matt@ucc.asn.au>2007-02-12 13:38:18 +0000
committerMatt Johnston <matt@ucc.asn.au>2007-02-12 13:38:18 +0000
commite1a4149ba40b761de1f2a1dd4bedc4c8854034f7 (patch)
treecc674169413bc9c7e4e8b90728c754bbdbd66a59
parent2e1fb8b3ae9b8794511cc418cd91eb54565038ab (diff)
parente1d814eb5be13dfbc859376110433e0712388994 (diff)
downloaddropbear-channel-fix.tar.gz
propagate from branch 'au.asn.ucc.matt.dropbear' (head 6cb7793493d92968e09b5dea21d71ded5811d21f)channel-fix
to branch 'au.asn.ucc.matt.dropbear.channel-fix' (head 275bf5c6b71ca286c29733b9e38bac40eeb06a40)
-rw-r--r--cli-main.c2
-rw-r--r--dbutil.c6
-rw-r--r--dbutil.h1
-rw-r--r--includes.h1
-rw-r--r--packet.c4
-rw-r--r--process-packet.c1
-rw-r--r--svr-main.c2
7 files changed, 12 insertions, 5 deletions
diff --git a/cli-main.c b/cli-main.c
index 3f767c9..68cf023 100644
--- a/cli-main.c
+++ b/cli-main.c
@@ -47,6 +47,8 @@ int main(int argc, char ** argv) {
_dropbear_exit = cli_dropbear_exit;
_dropbear_log = cli_dropbear_log;
+ disallow_core();
+
cli_getopts(argc, argv);
TRACE(("user='%s' host='%s' port='%s'", cli_opts.username,
diff --git a/dbutil.c b/dbutil.c
index f06b8bf..4559ba9 100644
--- a/dbutil.c
+++ b/dbutil.c
@@ -693,3 +693,9 @@ void setnonblocking(int fd) {
}
TRACE(("leave setnonblocking"))
}
+
+void disallow_core() {
+ struct rlimit lim;
+ lim.rlim_cur = lim.rlim_max = 0;
+ setrlimit(RLIMIT_CORE, &lim);
+}
diff --git a/dbutil.h b/dbutil.h
index d74e17e..856978d 100644
--- a/dbutil.h
+++ b/dbutil.h
@@ -63,6 +63,7 @@ void * m_realloc(void* ptr, size_t size);
void __m_free(void* ptr);
void m_burn(void* data, unsigned int len);
void setnonblocking(int fd);
+void disallow_core();
/* Used to force mp_ints to be initialised */
#define DEF_MP_INT(X) mp_int X = {0, 0, 0, NULL}
diff --git a/includes.h b/includes.h
index 1fcf634..017de66 100644
--- a/includes.h
+++ b/includes.h
@@ -38,6 +38,7 @@
#include <sys/time.h>
#include <sys/un.h>
#include <sys/wait.h>
+#include <sys/resource.h>
#include <stdio.h>
#include <errno.h>
diff --git a/packet.c b/packet.c
index b2c6174..9e7c67a 100644
--- a/packet.c
+++ b/packet.c
@@ -446,10 +446,6 @@ void encrypt_packet() {
}
/* finished with payload */
- buf_burn(ses.writepayload); /* XXX This is probably a good idea, and isn't
- _that_ likely to hurt performance too badly.
- Buffers can have cleartext passwords etc, or
- other sensitive data */
buf_setpos(ses.writepayload, 0);
buf_setlen(ses.writepayload, 0);
diff --git a/process-packet.c b/process-packet.c
index 07fc130..ba39d9f 100644
--- a/process-packet.c
+++ b/process-packet.c
@@ -119,7 +119,6 @@ void process_packet() {
recv_unimplemented();
out:
- buf_burn(ses.payload); /* Clear the memory to avoid swapping it out */
buf_free(ses.payload);
ses.payload = NULL;
diff --git a/svr-main.c b/svr-main.c
index e228acf..ddf5445 100644
--- a/svr-main.c
+++ b/svr-main.c
@@ -52,6 +52,8 @@ int main(int argc, char ** argv)
_dropbear_exit = svr_dropbear_exit;
_dropbear_log = svr_dropbear_log;
+ disallow_core();
+
/* get commandline options */
svr_getopts(argc, argv);