[29626] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.14]: Fix leaks on error in krb5 gss_acquire_cred()
daemon@ATHENA.MIT.EDU (Tom Yu)
Fri Sep 2 17:13:28 2016
Date: Fri, 2 Sep 2016 17:04:21 -0400
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201609022104.u82L4LpS023593@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/843ffd81a9fc7899d9d3ee8615f054fbfa1b81a4
commit 843ffd81a9fc7899d9d3ee8615f054fbfa1b81a4
Author: Greg Hudson <ghudson@mit.edu>
Date: Mon Jun 27 17:49:57 2016 -0400
Fix leaks on error in krb5 gss_acquire_cred()
In acquire_cred_context(), when releasing the partially constructed
cred on error, make sure to free the password and impersonator fields,
and to destroy the ccache if we created it.
(cherry picked from commit ee7315964e52fe351ddb6884e0e8baf1ecce2144)
ticket: 8437
version_fixed: 1.14.4
src/lib/gssapi/krb5/acquire_cred.c | 10 ++++++++--
1 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c
index 6e83fb9..4505ba5 100644
--- a/src/lib/gssapi/krb5/acquire_cred.c
+++ b/src/lib/gssapi/krb5/acquire_cred.c
@@ -847,8 +847,12 @@ krb_error_out:
error_out:
if (cred != NULL) {
- if (cred->ccache)
- krb5_cc_close(context, cred->ccache);
+ if (cred->ccache) {
+ if (cred->destroy_ccache)
+ krb5_cc_destroy(context, cred->ccache);
+ else
+ krb5_cc_close(context, cred->ccache);
+ }
if (cred->client_keytab)
krb5_kt_close(context, cred->client_keytab);
#ifndef LEAN_CLIENT
@@ -859,6 +863,8 @@ error_out:
krb5_rc_close(context, cred->rcache);
if (cred->name)
kg_release_name(context, &cred->name);
+ krb5_free_principal(context, cred->impersonator);
+ zapfreestr(cred->password);
k5_mutex_destroy(&cred->lock);
xfree(cred);
}
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
