mount.cifs: don't leak passwords with verbose option
commita9cdec42bf587aad5bdd22a196a8f37c68270b23
authorJeff Layton <jlayton@redhat.com>
Fri, 25 Sep 2009 11:05:00 +0000 (25 07:05 -0400)
committerKarolin Seeger <kseeger@samba.org>
Thu, 1 Oct 2009 12:25:01 +0000 (1 14:25 +0200)
tree7539c3b8d82c6c64ceb2ab4ba3800c8697918a18
parent6aa5d772a91b34860f4717d504d2ddcd833c730a
mount.cifs: don't leak passwords with verbose option

When running mount.cifs with the --verbose option, it'll print out the
option string that it passes to the kernel...including the mount
password if there is one. Print a placeholder string instead to help
ensure that this info can't be used for nefarious purposes.

Also, the --verbose option printed the option string before it was
completely assembled anyway. This patch should also make sure that
the complete option string is printed out.

Finally, strndup passwords passed in on the command line to ensure that
they aren't shown by --verbose as well. Passwords used this way can
never be truly kept private from other users on the machine of course,
but it's simple enough to do it this way for completeness sake.

Reported-by: Ronald Volgers <r.c.volgers@student.utwente.nl>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Steve French <sfrench@us.ibm.com>
Part 2/2 of a fix for CVE-2009-2948.
(cherry picked from commit 1c2a816df9fd9e3a3839a679a72b3041b0217dc3)
source/client/mount.cifs.c