passwordsafe-devel — For developers of Password Safe

[Passwordsafe-devel] SecString class

[Edward E. <ed...@ya...>]

Hi all,

A few weeks ago, ignorant of this list, I emailed Jim Russell about a
problem with the PWSafe source.  I noticed the SecString class at that
time was subclassing std::string, which is a big no-no since
std::string
has no virtual destructor.  In some instances, this can lead to the
SecString destructor never being called, and hence the memory buffer 
with the SecString contents never getting cleared.

I suggested a better approach would be to write an allocator that
clears memory on release, then make SecString an instantiation of
the std::string template using this allocator.  The beauty of this
solution is you can create any STL container that clears its memory on 
release.  I mentioned I would be writing such an allocator class myself
soon for another project and would gladly provide a copy of the source.

Well, as I was browsing the Crypto++ library I came across an allocator
class (template, actually) written by a Denis Bider that does exactly
that.  On Windows platforms, it also attempts to lock the pages in
memory with the VirtualLock() system call.  I was contemplating adding
this functionality to my allocator as well, although the MSDN 
information is conflicting as to whether VirtualLock actually locks the
pages in memory or just hints to the OS that is should do so.  Anyway,
the allocator is available (no license restrictions) as part of the
BSL library at

    http://www.bitvise.com/bsl.html

I don't know this Denis Bider and I can't vouch for the quality of
the code.  But on first pass it looks reasonably solid.  My one 
complaint would be the simplistic memory overwriting which merely
zeroes the memory out one time, but this can easily be changed.  I
hope to give the code a more thorough review in the near future.  At
that time I will inform this list of my findings and provide and code
changes I make.  Thanks,

Edward Elliott


__________________________________________________
Do You Yahoo!?
Yahoo! Greetings - Send FREE e-cards for every occasion!
http://greetings.yahoo.com

Re: [Passwordsafe-devel] Development source

[Jim R. <jru...@us...>]

On or about Thu, Jan 31, 2002 at 08:41:29PM -0000, Martyn Pa...@Ma... wrote:

> Does anyone have a source set for a win32 platform?

As it stands now, the *only* source set is the one for the win32 
platform, especially considering the fact that it's currently
MFC-based.

> I have taken a look at the source available from the CVS system and have a number of comments to make but would like to base my comments of a solid foundation.

The source in CVS is what I checked in.  It consists of the v1.7 
source as provided to me by Bruce S. (the Counterpane Source) with 
the fixes marked on the TODO page at passwordsafe.sourceforge.net 
already applied.  One or two of the modules that I've started to 
write to separate the backend engine from the GUI are also in 
CVS, but are not in the Makefile yet, and are not yet used in 
the application.

I have a few more changes that have not been checked in yet, but 
the last few weeks have been a bit of a speed bump in Password 
Safe development (the company I worked for dissolved, and I've 
been spending a lot of time job-hunting).

Anyway -- Martin, the CVS source is about as solid a foundation 
as we have right now, so comment away based on that.


Jim R

[Passwordsafe-devel] Development source

[Martyn <Pa...@Ma...>]

Dear All

Does anyone have a source set for a win32 platform?

I have taken a look at the source available from the CVS system and have =
a number of comments to make but would like to base my comments of a =
solid foundation.

Martyn Pavey

[Passwordsafe-devel] The Mailing Lists are up and running

[Jim R. <jru...@us...>]

UPFRONT APOLOGY -- You may get more than one copy of this email.  I'm 
posting it to three mailing lists, and BCC'ing to a number of addresses. 
We'll get it all sorted out soon enough. <g>

Now that that's out of the way...

Thanks to everyone for their messages of congratulations/condolences 
on my appointment as maintainer of PasswordSafe.  You are receiving 
this message either because you subscribed to one of the mailing lists 
I've set up, or because I'm inviting you to do so.  PasswordSafe from 
this point forward will be, I hope, a collaborative effort, and 
mailing lists are a nice public way of hashing out where the 
development effort should go.

The mailing lists are pretty much what you would expect:

passwordsafe-devel -- subscribe to this one if you want to do some 
coding or documentation

passwordsafe-users -- subscribe to this one if you want to submit 
bug reports, feature requests, or complain about the user interface

passwordsafe-announce -- subscribe to this one if you only want to 
know when the next version is released


So subscribe if you haven't yet, and lets get rolling.  Point a 
browser to:

    https://sourceforge.net/mail/?group_id=41019


Jim R