Nullify QString data bytes

Viewed 664

I use QStrings to store passwords. If to be more precise, I use QStrings to fetch passwords from GUI. The point is that after password usage/appliance I need to nullify (zero) internal QStrings data bytes with password to eliminate it from memory entirely.

Here are my investigations:

  • After QString destruction it's data remains in memory nonzeroed;
  • When I attempt to modify QString to fulfill it with zeroes it triggers copy-on-write idiom and allocates new memory for a modified variant of data. Old data remains untouched. Same happens even if I use QString::data() method. Not really sure why - probably because it returns not raw char * but QChar *;
  • QString::clear(), = "" does actually the same COW as described above.

Q: How can I implement proper QString cleanup to prevent passwords leaks?

2 Answers
Related