Date: Wed, 11 May 2016 23:25:59 +0000 (UTC) From: "Conrad E. Meyer" <cem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r299495 - head/crypto/heimdal/lib/krb5 Message-ID: <201605112325.u4BNPxxN059596@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cem Date: Wed May 11 23:25:59 2016 New Revision: 299495 URL: https://svnweb.freebsd.org/changeset/base/299495 Log: libkrb5: Fix potential double-free If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed memory and then be double-freed. After freeing it the first time, initialize it to NULL, which causes subsequent krb5_free_principal calls to do the right thing. Reported by: Coverity CID: 1273430 Sponsored by: EMC / Isilon Storage Division Modified: head/crypto/heimdal/lib/krb5/get_cred.c Modified: head/crypto/heimdal/lib/krb5/get_cred.c ============================================================================== --- head/crypto/heimdal/lib/krb5/get_cred.c Wed May 11 23:16:11 2016 (r299494) +++ head/crypto/heimdal/lib/krb5/get_cred.c Wed May 11 23:25:59 2016 (r299495) @@ -831,6 +831,7 @@ get_cred_kdc_capath_worker(krb5_context if(strcmp(tgt_inst, server_realm) == 0) break; krb5_free_principal(context, tmp_creds.server); + tmp_creds.server = NULL; ret = krb5_make_principal(context, &tmp_creds.server, tgt_inst, KRB5_TGS_NAME, server_realm, NULL); if(ret) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605112325.u4BNPxxN059596>