[tor-commits] [tor/release-0.4.4] Wipe address strings from connections before freeing them them.

[asn at torproject.org]

commit ea876ab00e223b0c1ba022cc27861cfbbde31b64
Author: Nick Mathewson <nickm at torproject.org>
Date:   Mon Aug 3 10:15:08 2020 -0400

    Wipe address strings from connections before freeing them them.
    
    This is a defense-in-depth fix; closes 6198.
---
 changes/ticket6198             | 3 +++
 src/core/mainloop/connection.c | 8 ++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/changes/ticket6198 b/changes/ticket6198
new file mode 100644
index 0000000000..7f3fdf2fa7
--- /dev/null
+++ b/changes/ticket6198
@@ -0,0 +1,3 @@
+  o Minor features (defense in depth):
+    - Wipe more data from connection address fields before returning them to
+      the memory heap. Closes ticket 6198.
diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c
index 3595bba85c..4b321fe72f 100644
--- a/src/core/mainloop/connection.c
+++ b/src/core/mainloop/connection.c
@@ -637,7 +637,7 @@ connection_free_minimal(connection_t *conn)
     }
   }
 
-  tor_free(conn->address);
+  tor_str_wipe_and_free(conn->address);
 
   if (connection_speaks_cells(conn)) {
     or_connection_t *or_conn = TO_OR_CONN(conn);
@@ -657,7 +657,7 @@ connection_free_minimal(connection_t *conn)
     }
     or_handshake_state_free(or_conn->handshake_state);
     or_conn->handshake_state = NULL;
-    tor_free(or_conn->nickname);
+    tor_str_wipe_and_free(or_conn->nickname);
     if (or_conn->chan) {
       /* Owww, this shouldn't happen, but... */
       channel_t *base_chan = TLS_CHAN_TO_BASE(or_conn->chan);
@@ -677,8 +677,8 @@ connection_free_minimal(connection_t *conn)
   }
   if (conn->type == CONN_TYPE_AP) {
     entry_connection_t *entry_conn = TO_ENTRY_CONN(conn);
-    tor_free(entry_conn->chosen_exit_name);
-    tor_free(entry_conn->original_dest_address);
+    tor_str_wipe_and_free(entry_conn->chosen_exit_name);
+    tor_str_wipe_and_free(entry_conn->original_dest_address);
     if (entry_conn->socks_request)
       socks_request_free(entry_conn->socks_request);
     if (entry_conn->pending_optimistic_data) {