<div dir="ltr"><div><div>I apologize for the pause. I'm somewhat inexperienced at git, and am unsure how to make a pull request to a non-github repository. <br><br></div>The commit I showed you is still at [1], but I've now cherry-picked it into its own branch at [2]. I've also run a `git request-pull` on my local machine, whose results I have copied below, but I don't think that actually sent anything to you. How do I make a pull request? Sorry for such a newbie question.<br><br></div><div>Output of `git request-pull`:<br><br>"""<br>alan-14:03>git request-pull -p master <a href="https://github.com/keyme/libfprint">https://github.com/keyme/libfprint</a> g_malloc0<br>The following changes since commit 9570c36fd42bff6246de50ace398a457b9495b46:<br><br> build: Fix running autogen.sh out-of-tree (2016-07-19 11:18:58 +0200)<br><br>are available in the git repository at:<br><br> <a href="https://github.com/keyme/libfprint">https://github.com/keyme/libfprint</a> g_malloc0<br><br>for you to fetch changes up to 0d0fa5a523662e69c3929b2fe530d9d36e2f06d3:<br><br> Fix security hole: zero out memory when allocated (2016-08-23 14:03:03 -0400)<br><br>----------------------------------------------------------------<br>Alan Davidson (1):<br> Fix security hole: zero out memory when allocated<br><br> libfprint/data.c | 2 +-<br> 1 file changed, 1 insertion(+), 1 deletion(-)<br>"""<br></div><div><br></div> - Alan<br><br>[1] <a href="https://github.com/keyme/libfprint/commit/1b71aff9ea389c427f9f8bfaabf8aa0acde37269">https://github.com/keyme/libfprint/commit/1b71aff9ea389c427f9f8bfaabf8aa0acde37269</a><br>[2] <a href="https://github.com/keyme/libfprint/compare/g_malloc0?expand=1">https://github.com/keyme/libfprint/compare/g_malloc0?expand=1</a><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 19, 2016 at 12:49 PM, Alan Davidson <span dir="ltr"><<a href="mailto:alan@key.me" target="_blank">alan@key.me</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Thanks for taking a look! and thanks for maintaining this library; it's very useful.<span class="HOEnZb"><font color="#888888"><br><br></font></span></div><span class="HOEnZb"><font color="#888888"> - Alan<br></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 19, 2016 at 1:56 AM, Vasily Khoruzhick <span dir="ltr"><<a href="mailto:anarsoul@gmail.com" target="_blank">anarsoul@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Alan,<br>
<br>
Thanks for your e-mail and patch.<br>
<br>
I expect it to be in worst case some re-used memory of libfprint, so<br>
it's not really a security leak, since the only sensitive information<br>
is saved to the disk. But I'll take your patch.<br>
<br>
Regards,<br>
Vasily<br>
<div><div><br>
On Thu, Aug 18, 2016 at 3:01 PM, Alan Davidson <<a href="mailto:alan@key.me" target="_blank">alan@key.me</a>> wrote:<br>
> Hi libfprint folks -<br>
><br>
> I was enrolling fingerprints and saving the data to files (using<br>
> fp_print_data_get_data), when I noticed that the data section for the<br>
> minutiae had interesting stuff in the unused parts. This is to say, the<br>
> xyt_struct (from bozorth.h) allocates space for 200 minutiae, and if I only<br>
> use 50 of them, the other 150 are still allocated and have stuff in them.<br>
> These values come from things that were previously allocated and deallocated<br>
> on the heap, and the data is still there because it wasn't zeroed out when<br>
> we re-allocated it.<br>
><br>
> I think it should be zeroed out, to prevent leaking whatever used to be in<br>
> this memory. What do you think? It's a very easy change; see the commit at<br>
> [1], though I'm unclear how to transfer it to your repo. Without this<br>
> change, enrolled fingerprints saved to file on my computer have non-null<br>
> data in the unused minutiae, and with it, all the unused minutiae are full<br>
> of null bytes.<br>
><br>
> A little more detail: this happens in fpi_img_to_print_data (in img.c), when<br>
> we create a new item to store the minutiae in xyt format. The data is later<br>
> copied wholesale into the output buffer in fp_print_data_get_data.<br>
><br>
> Thanks for taking a look!<br>
><br>
> - Alan<br>
><br>
> [1]<br>
> <a href="https://github.com/keyme/libfprint/commit/1b71aff9ea389c427f9f8bfaabf8aa0acde37269" rel="noreferrer" target="_blank">https://github.com/keyme/libfp<wbr>rint/commit/1b71aff9ea389c427f<wbr>9f8bfaabf8aa0acde37269</a><br>
><br>
</div></div>> ______________________________<wbr>_________________<br>
> fprint mailing list<br>
> <a href="mailto:fprint@lists.freedesktop.org" target="_blank">fprint@lists.freedesktop.org</a><br>
> <a href="https://lists.freedesktop.org/mailman/listinfo/fprint" rel="noreferrer" target="_blank">https://lists.freedesktop.org/<wbr>mailman/listinfo/fprint</a><br>
><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>