[31581] in CVS-changelog-for-Kerberos-V5
krb5 commit: Prevent dangling result in tl_data2berval()
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Fri Sep 4 19:31:44 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260904233137.52D671016EB@krbdev.mit.edu>
Date: Fri, 4 Sep 2026 19:31:37 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: multipart/mixed; boundary="===============0454460014848359843=="
Errors-To: cvs-krb5-bounces@mit.edu
--===============0454460014848359843==
Content-Type: text/plain
https://github.com/krb5/krb5/commit/6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d
commit 6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d
Author: Greg Hudson <ghudson@mit.edu>
Date: Mon Aug 31 17:56:46 2026 -0400
Prevent dangling result in tl_data2berval()
If the second malloc() fails in tl_data2berval(), do not leave a
dangling freed pointer in *out, or the caller will free it a second
time. Reported by Vidal Segura García.
ticket: 9232
tags: pullup
target_version: 1.22-next
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 9aa68bacd..5bacaee28 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -628,20 +628,24 @@ cleanup:
static krb5_error_code
tl_data2berval (krb5_tl_data *in, struct berval **out)
{
- *out = (struct berval *) malloc (sizeof (struct berval));
- if (*out == NULL)
- return ENOMEM;
+ struct berval *bv;
- (*out)->bv_len = in->tl_data_length + 2;
- (*out)->bv_val = (char *) malloc ((*out)->bv_len);
- if ((*out)->bv_val == NULL) {
- free (*out);
+ *out = NULL;
+
+ bv = malloc(sizeof(*bv));
+ if (bv == NULL)
+ return ENOMEM;
+ bv->bv_len = in->tl_data_length + 2;
+ bv->bv_val = malloc(bv->bv_len);
+ if (bv->bv_val == NULL) {
+ free(bv);
return ENOMEM;
}
- STORE16_INT((*out)->bv_val, in->tl_data_type);
- k5memcpy((*out)->bv_val + 2, in->tl_data_contents, in->tl_data_length);
+ STORE16_INT(bv->bv_val, in->tl_data_type);
+ k5memcpy(bv->bv_val + 2, in->tl_data_contents, in->tl_data_length);
+ *out = bv;
return 0;
}
--===============0454460014848359843==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
--===============0454460014848359843==--
