From 63d86852407a595bcf7feb4c48a87722709fac53 Mon Sep 17 00:00:00 2001 From: Levi Neely <141506390+lneely@users.noreply.github.com> Date: Tue, 3 Mar 2026 17:11:10 +0100 Subject: [PATCH] Fix psync_my_pass wipe to use strlen instead of sizeof pointer (#338) In psync_unlink(), putil_wipe(psync_my_pass, sizeof(psync_my_pass)) only wiped 8 bytes (pointer size) instead of the full password string. Changed to strlen(psync_my_pass) and added NULL check. Fixes pcl-zqv.9.1 (partial) GH #276 Co-authored-by: Levi Neely --- pclsync/psynclib.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pclsync/psynclib.c b/pclsync/psynclib.c index 888ae9e..5862e17 100644 --- a/pclsync/psynclib.c +++ b/pclsync/psynclib.c @@ -343,8 +343,11 @@ void psync_logout(uint32_t auth_status, int doinvauth) { pcryptofolder_lock(); pthread_mutex_lock(&psync_my_auth_mutex); - putil_wipe(psync_my_pass, sizeof(psync_my_pass)); - free(psync_my_pass); + if (psync_my_pass) { + putil_wipe(psync_my_pass, strlen(psync_my_pass)); + free(psync_my_pass); + psync_my_pass = NULL; + } pthread_mutex_unlock(&psync_my_auth_mutex); pstatus_set(PSTATUS_TYPE_ONLINE, PSTATUS_ONLINE_CONNECTING);