Re: [PoC] Federated Authn/z with OAUTHBEARER - Mailing list pgsql-hackers

From Jacob Champion
Subject Re: [PoC] Federated Authn/z with OAUTHBEARER
Date
Msg-id CAOYmi+m4zFdp+cgMfUjZR9mfZC5rfraHR2Pfo4XZU0oZ-6+YYw@mail.gmail.com
Whole thread Raw
In response to [PoC] Federated Authn/z with OAUTHBEARER  (Jacob Champion <pchampion@vmware.com>)
List pgsql-hackers
On Fri, Oct 18, 2024 at 4:38 AM Daniel Gustafsson <daniel@yesql.se> wrote:
> In validate() it seems to me we should clear out ret->authn_id on failure to
> pair belts with suspenders. Fixed by calling explicit_bzero on it in the error
> path.

The new hunk says:

> cleanup:
>     /*
>      * Clear and free the validation result from the validator module once
>      * we're done with it to avoid accidental re-use.
>      */
>     if (ret->authn_id != NULL)
>     {
>         explicit_bzero(ret->authn_id, strlen(ret->authn_id));
>         pfree(ret->authn_id);
>     }
>     pfree(ret);

But I'm not clear on what's being protected against. Which code would
reuse this result?

Thanks,
--Jacob



pgsql-hackers by date:

Previous
From: Rahila Syed
Date:
Subject: Re: Using read_stream in index vacuum
Next
From: Andy Fan
Date:
Subject: Re: [PoC] Partition path cache