From 9f948224acb911cbec1ed9041887c1fe62c59877 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
Date: Tue, 8 Nov 2022 13:17:11 -0700
Subject: [PATCH] sudo_passwd_verify: zero out des_pass before returning.

---
 plugins/sudoers/auth/passwd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/plugins/sudoers/auth/passwd.c b/plugins/sudoers/auth/passwd.c
index 636c07bab..89da96ff6 100644
--- a/plugins/sudoers/auth/passwd.c
+++ b/plugins/sudoers/auth/passwd.c
@@ -95,5 +95,7 @@ sudo_passwd_verify(struct passwd *pw, const char *pass, sudo_auth *auth, struct
 	    matched = !strcmp(pw_epasswd, epass);
     }
 
+    explicit_bzero(des_pass, sizeof(des_pass));
+
     debug_return_int(matched ? AUTH_SUCCESS : AUTH_FAILURE);
 }
-- 
2.33.0

