[31669] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix leak on error in process_chpw_request()
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:01:51 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170148.C2796105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:01:48 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/ccb5c1c41a3eb24c7e3fb39066e43ae5bec0fb69
commit ccb5c1c41a3eb24c7e3fb39066e43ae5bec0fb69
Author: Julien Rische <jrische@redhat.com>
Date: Fri Sep 4 12:17:34 2026 +0200
Fix leak on error in process_chpw_request()
In process_chpw_request(), wipe the "clear" buffer before reusing it
in the chpwfail label.
[ghudson@mit.edu: removed conditionalization on wipe operation; edited
comment; rewrote commit message]
(cherry picked from commit ed1c283551adf9eca4758efca70d3c1698f8a27c)
ticket: 9263
version_fixed: 1.22.3
src/kadmin/server/schpw.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index 5b73a3d8d..1d7183f7a 100644
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -272,6 +272,10 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
chpwfail:
+ /* Wipe any decrypted data in clear if present, and reuse it for the error
+ * message plaintext. */
+ zapfree(clear.data, clear.length);
+ clear = empty_data();
ret = alloc_data(&clear, 2 + strlen(strresult));
if (ret)
goto bailout;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
