[31612] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix memory leak in mpool_get() error paths
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Tue Nov 3 19:17:59 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261104001754.9C2BE105851@krbdev.mit.edu>
Date: Tue, 3 Nov 2026 19:17:54 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/da8dc32eb382b7f3a5b870ee0ecbb769e33019ed
commit da8dc32eb382b7f3a5b870ee0ecbb769e33019ed
Author: Tigran Sogomonian <tsogomonian@astralinux.ru>
Date: Thu Oct 15 12:47:53 2026 +0300
Fix memory leak in mpool_get() error paths
If mpool_get() fails after obtaining a bucket from mpool_bkt() (offset
overflow, lseek failure, or partial read), the bucket is not on any
queue and is leaked. Free it and decrement curcache on these paths.
[ghudson@mit.edu: added cautionary comment to err label]
(cherry picked from commit 8f4c88a8b1bdb007f3d84f1280e7edf89a575ca4)
ticket: 9273
version_fixed: 1.22.3
src/plugins/kdb/db2/libdb2/mpool/mpool.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/src/plugins/kdb/db2/libdb2/mpool/mpool.c b/src/plugins/kdb/db2/libdb2/mpool/mpool.c
index 028fb180c..0182b8cf9 100644
--- a/src/plugins/kdb/db2/libdb2/mpool/mpool.c
+++ b/src/plugins/kdb/db2/libdb2/mpool/mpool.c
@@ -218,17 +218,17 @@ mpool_get(MPOOL *mp, db_pgno_t pgno, u_int flags)
/* Run past the end of the file, or at least the part we
can address without large-file support? */
errno = E2BIG;
- return NULL;
+ goto err;
}
if (lseek(mp->fd, off, SEEK_SET) != off)
- return (NULL);
+ goto err;
if ((nr = read(mp->fd, bp->page, mp->pagesize)) !=
(ssize_t)mp->pagesize) {
if (nr > 0) {
/* A partial read is definitely bad. */
errno = EINVAL;
- return (NULL);
+ goto err;
} else {
/*
* A zero-length reads, means you need to create a
@@ -257,6 +257,13 @@ mpool_get(MPOOL *mp, db_pgno_t pgno, u_int flags)
(mp->pgin)(mp->pgcookie, bp->pgno, bp->page);
return (bp->page);
+
+err:
+ /* Only use this label after the mpool_bkt() call. mpool_bkt()
+ * returned a fresh or unlinked page; drop it. */
+ free(bp);
+ mp->curcache--;
+ return (NULL);
}
/*
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
