[31583] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Prevent dangling result in tl_data2berval()
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Fri Sep 4 20:00:08 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260905000002.7984D1056F8@krbdev.mit.edu>
Date: Fri, 4 Sep 2026 20:00:02 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: multipart/mixed; boundary="===============3035329972108491963=="
Errors-To: cvs-krb5-bounces@mit.edu
--===============3035329972108491963==
Content-Type: text/plain
https://github.com/krb5/krb5/commit/5dbd6ba425eecf76396d2f78b79738983b255c20
commit 5dbd6ba425eecf76396d2f78b79738983b255c20
Author: Greg Hudson <ghudson@mit.edu>
Date: Mon Aug 31 17:56:46 2026 -0400
Prevent dangling result in tl_data2berval()
If the second malloc() fails in tl_data2berval(), do not leave a
dangling freed pointer in *out, or the caller will free it a second
time. Reported by Vidal Segura García.
(cherry picked from commit 6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d)
ticket: 9232
version_fixed: 1.22.3
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 525e8d027..251da025b 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -628,20 +628,24 @@ cleanup:
static krb5_error_code
tl_data2berval (krb5_tl_data *in, struct berval **out)
{
- *out = (struct berval *) malloc (sizeof (struct berval));
- if (*out == NULL)
- return ENOMEM;
+ struct berval *bv;
- (*out)->bv_len = in->tl_data_length + 2;
- (*out)->bv_val = (char *) malloc ((*out)->bv_len);
- if ((*out)->bv_val == NULL) {
- free (*out);
+ *out = NULL;
+
+ bv = malloc(sizeof(*bv));
+ if (bv == NULL)
+ return ENOMEM;
+ bv->bv_len = in->tl_data_length + 2;
+ bv->bv_val = malloc(bv->bv_len);
+ if (bv->bv_val == NULL) {
+ free(bv);
return ENOMEM;
}
- STORE16_INT((*out)->bv_val, in->tl_data_type);
- memcpy ((*out)->bv_val + 2, in->tl_data_contents, in->tl_data_length);
+ STORE16_INT(bv->bv_val, in->tl_data_type);
+ memcpy(bv->bv_val + 2, in->tl_data_contents, in->tl_data_length);
+ *out = bv;
return 0;
}
--===============3035329972108491963==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
--===============3035329972108491963==--
