[PYTHON-CRYPTO] Erasing strings from memory?

[Jeremy Hylton]

>>>>> "PS" == Paul Swartz <z3p at TWISTEDMATRIX.COM> writes:

  >> Good point.  Check that refcount==1 before actual memset.  /r$

  PS> I don't know.  I liked that the old code cleared all the
  PS> references to the string so I don't have to worry about
  PS> misc. references sitting around keeping this string in memory.
  PS> Does python really care if strings change on it?

Yes.  Python depends in a lot of ways on strings being immutable.  If
the string gets stuffed in a dictionary and you modify it, you'll get
unpredictable results.  The string can also be interned.  You can't
modify a string in the intern table.

I think the test for refcount==1 isn't sufficient.  I wrote a zap
module a couple of years ago that did much the same thing.  (Not sure
what happened to the code.)  It's almost impossible to call a function
to zap a string and have it's refcount be 1.  The mere fact that it is
on the call stack will add at least one reference.

I think the solution is to verify that it is not interned (ob_sstate),
then recalculate the hash after zapping the string.

Jeremy