[31327] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.21]: Fix krb5_cccol_have_content() bad pointer
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Jun 24 19:50:51 2024
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20240624235048.2275D101A5F@krbdev.mit.edu>
Date: Mon, 24 Jun 2024 19:50:48 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/bdfb45dd88fe222df03086158b1b52c5056847a5
commit bdfb45dd88fe222df03086158b1b52c5056847a5
Author: Ilya Gladyshev <ilya.v.gladyshev@gmail.com>
Date: Wed Aug 30 21:19:59 2023 +0100
Fix krb5_cccol_have_content() bad pointer free
krb5_cccol_have_content() calls krb5_cc_get_principal() within a loop,
and frees the resulting principal on success or failure. Set princ to
null before each call to ensure we don't free a dangling pointer.
[ghudson@mit.edu: rewrote commit message; moved assignment for greater
clarity]
(cherry picked from commit 635c8cca65b745476d07c1f5ff701445db25c10d)
ticket: 9103
version_fixed: 1.21.3
src/lib/krb5/ccache/cccursor.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/lib/krb5/ccache/cccursor.c b/src/lib/krb5/ccache/cccursor.c
index 4bcb66b71..926873f2a 100644
--- a/src/lib/krb5/ccache/cccursor.c
+++ b/src/lib/krb5/ccache/cccursor.c
@@ -249,6 +249,7 @@ krb5_cccol_have_content(krb5_context context)
save_first_error(context, ret, &errsave);
if (ret || cache == NULL)
break;
+ princ = NULL;
ret = krb5_cc_get_principal(context, cache, &princ);
save_first_error(context, ret, &errsave);
if (!ret)
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
