[31665] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix memory leak in auth_gssapi_wrap_data()
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:01:35 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170131.5DDDC105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:01:31 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/945964b2399416f424bd9ba255f6c12b9511d832
commit 945964b2399416f424bd9ba255f6c12b9511d832
Author: Julien Rische <jrische@redhat.com>
Date: Thu Sep 3 18:27:50 2026 +0200
Fix memory leak in auth_gssapi_wrap_data()
In auth_gssapi_wrap_data(), use a cleanup handler to ensure that
out_buf is freed along all exit paths.
[ghudson@mit.edu: added initializer for out_buf; made out_buf cleanup
unconditional; minor style edits; rewrote commit message]
(cherry picked from commit 2fd1fdd559f6c9d04127d6fdfc67154baa75317e)
ticket: 9264
version_fixed: 1.22.3
src/lib/rpc/auth_gssapi_misc.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
diff --git a/src/lib/rpc/auth_gssapi_misc.c b/src/lib/rpc/auth_gssapi_misc.c
index 72ae57aa0..63db6dcc6 100644
--- a/src/lib/rpc/auth_gssapi_misc.c
+++ b/src/lib/rpc/auth_gssapi_misc.c
@@ -196,11 +196,12 @@ bool_t auth_gssapi_wrap_data(
xdrproc_t xdr_func,
caddr_t xdr_ptr)
{
- gss_buffer_desc in_buf, out_buf;
+ gss_buffer_desc in_buf, out_buf = { 0 };
XDR temp_xdrs;
int conf_state;
unsigned int length;
char *cp;
+ bool_t success = FALSE;
PRINTF(("gssapi_wrap_data: starting\n"));
@@ -213,15 +214,13 @@ bool_t auth_gssapi_wrap_data(
PRINTF(("gssapi_wrap_data: encoding seq_num %d\n", seq_num));
if (! xdr_u_int32(&temp_xdrs, &seq_num)) {
PRINTF(("gssapi_wrap_data: serializing seq_num failed\n"));
- XDR_DESTROY(&temp_xdrs);
- return FALSE;
+ goto cleanup;
}
/* serialize the arguments into local memory */
if (!(*xdr_func)(&temp_xdrs, xdr_ptr)) {
PRINTF(("gssapi_wrap_data: serializing arguments failed\n"));
- XDR_DESTROY(&temp_xdrs);
- return FALSE;
+ goto cleanup;
}
in_buf.length = xdr_getpos(&temp_xdrs);
@@ -230,10 +229,8 @@ bool_t auth_gssapi_wrap_data(
*major = gss_seal(minor, context, 1,
GSS_C_QOP_DEFAULT, &in_buf, &conf_state,
&out_buf);
- if (*major != GSS_S_COMPLETE) {
- XDR_DESTROY(&temp_xdrs);
- return FALSE;
- }
+ if (*major != GSS_S_COMPLETE)
+ goto cleanup;
PRINTF(("gssapi_wrap_data: %d bytes data, %d bytes sealed\n",
(int) in_buf.length, (int) out_buf.length));
@@ -243,16 +240,17 @@ bool_t auth_gssapi_wrap_data(
cp = out_buf.value;
if (! xdr_bytes(out_xdrs, &cp, &length, out_buf.length)) {
PRINTF(("gssapi_wrap_data: serializing encrypted data failed\n"));
- XDR_DESTROY(&temp_xdrs);
- return FALSE;
+ goto cleanup;
}
out_buf.value = cp;
- *major = gss_release_buffer(minor, &out_buf);
-
PRINTF(("gssapi_wrap_data: succeeding\n\n"));
+ success = TRUE;
+
+cleanup:
+ gss_release_buffer(minor, &out_buf);
XDR_DESTROY(&temp_xdrs);
- return TRUE;
+ return success;
}
bool_t auth_gssapi_unwrap_data(
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
