sodium_malloc() does not check return value from sodium_mlock() about libsodium HOT 2 CLOSED

The relevant documentation is this:

In addition, sodium_mlock() is called on the region to help avoid it being swapped to disk.

(found here)

I think clarification would be appropriate here, e.g.:

In addition, sodium_mlock() is called on the region to help avoid it being swapped to disk. Note however that sodium_mlock() may fail, in which case sodium_malloc() will return the memory regardless, but it will not be mlocked. If you need to rely on mlocking, consider calling sodium_mlock() explicitly, and checking its return value.

I would also suggest documenting this design decision in the source code, to avoid future misunderstandings of this kind.

from libsodium.

These system calls are intentionally not checked here.

We can't guarantee that sodium_malloc() can lock memory. On some environments, memory locking just doesn't exist. On others, such as WebAssembly, the function is failing right now, but may eventually work (and this will, very likely, also depend on the runtime).

On other systems, the system call may or may not work according to the system configuration and the amount of already locked memory, which is very non-deterministic.

For many application developers, sodium_malloc() would be seen as something that "randomly fails" and would discourage its use.

The reason is was introduced is to mitigate heartbleed-like attacks. It can also be used as a general bound checking mechanism, and it's widely used that way in the test suite. Locking memory is just a bonus step, but without any guarantees. If the documentation states it otherwise or is confusing, that should be clarified.

For cases where memory locking is absolutely required, there is the sodium_mlock() function.

from libsodium.