lib/agetpass.*: Use alloca(3) to minimize visibility of passwords

The stack should have enough space for PASS_MAX+2 allocations.

Signed-off-by: Alejandro Colomar <[email protected]>

Author: alejandro-colomar

lib/agetpass.c

@@ -8,4 +8,5 @@
 
 
 extern inline void erase_pass(char *pass);
-extern inline char *agetpass_internal(const char *prompt, int flags);
+extern inline char *getpass_(char pass[SIZE_MAX + 2], const char *prompt,
+    int flags);

lib/agetpass.h

@@ -8,32 +8,33 @@
 
 #include <config.h>
 
+#include <alloca.h>
+#include <errno.h>
 #include <limits.h>
 #include <readpassphrase.h>
+#include <stddef.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include "alloc/malloc.h"
-
-#if WITH_LIBBSD == 0
-#include "freezero.h"
-#endif /* WITH_LIBBSD */
+#include "memzero.h"
 
 
 // Similar to getpass(3), but free of its problems.
-#define agetpass(prompt)  agetpass_internal(prompt, RPP_REQUIRE_TTY)
-#define agetpass_stdin()  agetpass_internal(NULL, RPP_STDIN)
+#define agetpass(prompt)  agetpass_(prompt, RPP_REQUIRE_TTY)
+#define agetpass_stdin()  agetpass_(NULL, RPP_STDIN)
+
+#define agetpass_(...)    getpass_(alloca(PASS_MAX + 2), __VA_ARGS__)
 
 
 inline void erase_pass(char *pass);
 ATTR_MALLOC(erase_pass)
-inline char *agetpass_internal(const char *prompt, int flags);
+inline char *getpass_(char pass[PASS_MAX + 2], const char *prompt, int flags);
 
 
 inline char *
-agetpass_internal(const char *prompt, int flags)
+getpass_(char pass[PASS_MAX + 2], const char *prompt, int flags)
 {
-	char    *pass;
 	size_t  len;
 
 	/*
@@ -44,10 +45,6 @@ agetpass_internal(const char *prompt, int flags)
 	 * Let's add one more byte, and if the password uses it, it
 	 * means the introduced password was longer than PASS_MAX.
 	 */
-	pass = MALLOC(PASS_MAX + 2, char);
-	if (pass == NULL)
-		return NULL;
-
 	if (readpassphrase(prompt, pass, PASS_MAX + 2, flags) == NULL)
 		goto fail;
 
@@ -60,15 +57,15 @@ agetpass_internal(const char *prompt, int flags)
 	return pass;
 
 fail:
-	freezero(pass, PASS_MAX + 2);
+	memzero(pass, PASS_MAX + 2);
 	return NULL;
 }
 
 
 inline void
 erase_pass(char *pass)
 {
-	freezero(pass, PASS_MAX + 2);
+	memzero(pass, PASS_MAX + 2);
 }