- icegridadmin when using username/password authentication now zeros

  the entire password after use.
- Fixed memset of password in the IceSSL impl.

1 files changed, 10 insertions, 2 deletions

diff --git a/cpp/src/IceGrid/Client.cpp b/cpp/src/IceGrid/Client.cpp
index 3776cbb08b8..7d107de0fa1 100644
--- a/cpp/src/IceGrid/Client.cpp
+++ b/cpp/src/IceGrid/Client.cpp
@@ -462,7 +462,11 @@ Client::run(int argc, char* argv[])
                 }
                      
                 session = AdminSessionPrx::uncheckedCast(router->createSession(id, password));
-                password = "";
+                // Zero the password string.
+                for(string::iterator p = password.begin(); p != password.end(); ++p)
+                {
+                    *p = '\0';
+                }
                 if(!session)
                 {
                     cerr << argv[0]
@@ -607,7 +611,11 @@ Client::run(int argc, char* argv[])
                 }
                     
                 session = registry->createAdminSession(id, password);
-                password = "";
+                // Zero the password string.
+                for(string::iterator p = password.begin(); p != password.end(); ++p)
+                {
+                    *p = '\0';
+                }
             }
 
             timeout = registry->getSessionTimeout();