CODEWITHSUNDEEP
c++memorystdincoredump
Ant
Ant

Reputation: 85

Clear stdin buffer (memory footprint)

The users of my application are asked to enter their password to start it. To get the password I simply use:

char c;  
std::string password;
while ...  // until the end of entry
{
    c = fgetc(stdin);
    password += c;
}

Once the password is checked I destroy the variable so it can't be retrieved using a core image of my program. For instance, if someone uses "gcore" command and then searches for the password in the core generated they will not find it.

But in my case, I can still retrieve the password value because it seems that it is still in the stdin buffer.

So my question is how can I clear stdin buffer to make the values typed by the user not available in memory anymore ?

I already tried: fflush, __fpurge, fwrite (from the beginning position of stdin stream)... and nothing seems to work.

Upvotes: 1

Views: 1360

Answers (4)

loreb
loreb

Reputation: 1357

I'm completely ignorant of C++, but what I'd do in C is either what DoxyLover suggested or, if you want to stick to using the standard library... use it without buffering, googling "c++ cin unbuffered" does give a few results after all

Upvotes: 0

Joel Trauger
Joel Trauger

Reputation: 732

Since you're using C++ why not just go with the std::string class and use cin>>password directly. this will eliminate the need for a separate variable to hold each character as it's typed. If, after that, you're still worried about the contents of stdin being available just use:

fseek(stdin,0,SEEK_END);

at the end of the read. In my opinion this is much easier to use than coding the old (and in my opinion, less secure) C methods and allows you to use the C++ libraries better.

General rule of thumb when coding C++: Don't use C unless you absolutely have to.

Upvotes: 0

Keven Wang
Keven Wang

Reputation: 1268

Have you checked this? How do I flush the cin buffer?

Try:

cin.clear();

Upvotes: 1

DoxyLover
DoxyLover

Reputation: 3484

My answer is: don't use stand I/O streams - use raw file I/O instead:

read(STDIN_FILENO, ...)

You'll have to do your own line buffering but you can guarantee that nothing in the libraries is keeping a buffer of your input.

Upvotes: 3

Related Questions