static void strstore(char **str, const char *newstr)
{
  if(*str)
    free(*str);
  *str = strdup(newstr);
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.