russell@unturf.com
01b9562d57
MOAD-0001 (CWE-407): CLEAN. AC trie, BM hash, and hash tables used throughout our hot scan paths. No linear membership scan in our critical code paths. MOAD-0002 (Intertangle): CLEAN. cl_engine is read-only during scan; cli_ctx is stack-local per scan_common invocation. MOAD-0003 (Leaked Context): CLEAN. No pthread thread-locals for scan identity; cli_ctx is per-scan-invocation stack variable. MOAD-0004 (Logged Secret): clamav-0001 — create_curl_handle() in libfreshclam/libfreshclam_internal.c:735 logs g_proxyPassword verbatim in our LOGG_ERROR path when curl_easy_setopt(CURLOPT_PROXYPASSWORD) fails. FreshClam logs are world-readable by default on Linux. Fix: remove our credential from our error message, retain our option name for debugging. MOAD-0005 (Thundering Herd): CLEAN. cache.c uses splay-tree-per-bucket with pthread_mutex_t protecting each bucket on every access.
14 lines
877 B
Diff
14 lines
877 B
Diff
--- a/libfreshclam/libfreshclam_internal.c
|
|
+++ b/libfreshclam/libfreshclam_internal.c
|
|
@@ -729,9 +729,9 @@ static CURL *create_curl_handle(const char *server, bool bCheckCert)
|
|
if (g_proxyUsername) {
|
|
if (CURLE_OK != curl_easy_setopt(curl, CURLOPT_PROXYUSERNAME, g_proxyUsername)) {
|
|
- logg(LOGG_ERROR, "create_curl_handle: Failed to set CURLOPT_PROXYUSERNAME (%s)!\n", g_proxyUsername);
|
|
+ logg(LOGG_ERROR, "create_curl_handle: Failed to set CURLOPT_PROXYUSERNAME!\n");
|
|
}
|
|
if (CURLE_OK != curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, g_proxyPassword)) {
|
|
- logg(LOGG_ERROR, "create_curl_handle: Failed to set CURLOPT_PROXYPASSWORD (%s)!\n", g_proxyPassword);
|
|
+ logg(LOGG_ERROR, "create_curl_handle: Failed to set CURLOPT_PROXYPASSWORD!\n");
|
|
}
|
|
}
|
|
}
|