mirror of
https://github.com/ElementsProject/elements.git
synced 2026-08-17 13:07:54 +02:00
00a0861181
`SecureString` is a `std::string` specialization with a secure allocator. However, it's treated like a C- string (no explicit length and null-terminated). This can cause unexpected behavior. For instance, if a user enters a passphrase with an embedded null character (which is possible through Qt and the JSON-RPC), it will ignore any characters after the null, giving the user a false sense of security. Instead of assigning `SecureString` via `std::string::c_str()`, assign it via a `std::string_view` of the original. This explicitly captures the size and doesn't make any extraneous copies in memory.
62 lines
2 KiB
C++
62 lines
2 KiB
C++
// Copyright (c) 2009-2010 Satoshi Nakamoto
|
|
// Copyright (c) 2009-2021 The Bitcoin Core developers
|
|
// Distributed under the MIT software license, see the accompanying
|
|
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
|
|
#ifndef BITCOIN_SUPPORT_ALLOCATORS_SECURE_H
|
|
#define BITCOIN_SUPPORT_ALLOCATORS_SECURE_H
|
|
|
|
#include <support/lockedpool.h>
|
|
#include <support/cleanse.h>
|
|
|
|
#include <memory>
|
|
#include <string>
|
|
|
|
//
|
|
// Allocator that locks its contents from being paged
|
|
// out of memory and clears its contents before deletion.
|
|
//
|
|
template <typename T>
|
|
struct secure_allocator : public std::allocator<T> {
|
|
using base = std::allocator<T>;
|
|
using traits = std::allocator_traits<base>;
|
|
using size_type = typename traits::size_type;
|
|
using difference_type = typename traits::difference_type;
|
|
using pointer = typename traits::pointer;
|
|
using const_pointer = typename traits::const_pointer;
|
|
using value_type = typename traits::value_type;
|
|
secure_allocator() noexcept {}
|
|
secure_allocator(const secure_allocator& a) noexcept : base(a) {}
|
|
template <typename U>
|
|
secure_allocator(const secure_allocator<U>& a) noexcept : base(a)
|
|
{
|
|
}
|
|
~secure_allocator() noexcept {}
|
|
template <typename _Other>
|
|
struct rebind {
|
|
typedef secure_allocator<_Other> other;
|
|
};
|
|
|
|
T* allocate(std::size_t n, const void* hint = nullptr)
|
|
{
|
|
T* allocation = static_cast<T*>(LockedPoolManager::Instance().alloc(sizeof(T) * n));
|
|
if (!allocation) {
|
|
throw std::bad_alloc();
|
|
}
|
|
return allocation;
|
|
}
|
|
|
|
void deallocate(T* p, std::size_t n)
|
|
{
|
|
if (p != nullptr) {
|
|
memory_cleanse(p, sizeof(T) * n);
|
|
}
|
|
LockedPoolManager::Instance().free(p);
|
|
}
|
|
};
|
|
|
|
// This is exactly like std::string, but with a custom allocator.
|
|
// TODO: Consider finding a way to make incoming RPC request.params[i] mlock()ed as well
|
|
typedef std::basic_string<char, std::char_traits<char>, secure_allocator<char> > SecureString;
|
|
|
|
#endif // BITCOIN_SUPPORT_ALLOCATORS_SECURE_H
|