Clear static buffer returned by getpass()

src/charon-cmd/cmd/cmd_creds.c

@@ -112,6 +112,7 @@ static shared_key_t* callback_shared(private_cmd_creds_t *this,
 		*match_other = ID_MATCH_PERFECT;
 	}
 	shared = shared_key_create(type, chunk_clone(chunk_from_str(pwd)));
+	memwipe(pwd, strlen(pwd));
 	/* cache password in case it is required more than once */
 	this->creds->add_shared(this->creds, shared, NULL);
 	return shared->get_ref(shared);

src/pki/pki.c

@@ -393,6 +393,7 @@ static shared_key_t* cb(void *data, shared_key_type_t type,
 			*match_other = ID_MATCH_NONE;
 		}
 		shared = shared_key_create(type, chunk_clone(chunk_from_str(secret)));
+		memwipe(secret, strlen(secret));
 		/* cache password in case it is required more than once */
 		cb_creds->add_shared(cb_creds, shared, NULL);
 		return shared->get_ref(shared);

src/stroke/stroke.c

@@ -129,6 +129,7 @@ static int send_stroke_msg(stroke_msg_t *msg)
 			if (pass)
 			{
 				stream->write_all(stream, pass, strlen(pass));
+				memwipe(pass, strlen(pass));
 				stream->write_all(stream, "\n", 1);
 			}
 		}

src/swanctl/commands/load_creds.c

@@ -254,6 +254,7 @@ CALLBACK(password_cb, shared_key_t*,
 		*match_other = ID_MATCH_PERFECT;
 	}
 	shared = shared_key_create(type, chunk_clone(chunk_from_str(pwd)));
+	memwipe(pwd, strlen(pwd));
 	/* cache secret if it is required more than once (PKCS#12) */
 	data->cache->add_shared(data->cache, shared, NULL);
 	return shared->get_ref(shared);
@@ -635,14 +636,13 @@ static void load_tokens(load_ctx_t *ctx)
 			{
 #ifdef HAVE_GETPASS
 				snprintf(prompt, sizeof(prompt), "PIN for %s: ", section);
-				pin = strdupnull(getpass(prompt));
+				pin = getpass(prompt);
 #endif
 			}
 			load_token(ctx, section, pin);
 			if (pin)
 			{
 				memwipe(pin, strlen(pin));
-				free(pin);
 				pin = NULL;
 			}
 		}