[31679] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix gssalloc mismatches
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:02:28 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170224.71A5F10583D@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:02:24 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/e7af9478d38150d11d127f1f9c0e02aab2217041
commit e7af9478d38150d11d127f1f9c0e02aab2217041
Author: Greg Hudson <ghudson@mit.edu>
Date: Mon Sep 21 22:41:51 2026 -0400
Fix gssalloc mismatches
Correct several mismatches where free() could be used on pointers
allocated with gssalloc_malloc() or vice versa. These mismatches are
generally harmless, but could cause heap corruption with older
versions of Visual Studio. Discovered by Aisle Research.
(cherry picked from commit e62bf3208f0ca622f63ecf01b186ebeafbe6eee5)
ticket: 9243
version_fixed: 1.22.3
src/lib/gssapi/mechglue/g_dsp_name_ext.c | 2 +-
src/lib/gssapi/mechglue/g_dup_name.c | 6 +++---
src/lib/gssapi/mechglue/g_imp_name.c | 3 +--
3 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/src/lib/gssapi/mechglue/g_dsp_name_ext.c b/src/lib/gssapi/mechglue/g_dsp_name_ext.c
index be08dd16c..edb290b1f 100644
--- a/src/lib/gssapi/mechglue/g_dsp_name_ext.c
+++ b/src/lib/gssapi/mechglue/g_dsp_name_ext.c
@@ -120,7 +120,7 @@ gss_display_name_ext (OM_uint32 *minor_status,
return GSS_S_UNAVAILABLE;
if ((output_name_buffer->value =
- malloc(union_name->external_name->length + 1)) == NULL) {
+ gssalloc_malloc(union_name->external_name->length + 1)) == NULL) {
return GSS_S_FAILURE;
}
output_name_buffer->length = union_name->external_name->length;
diff --git a/src/lib/gssapi/mechglue/g_dup_name.c b/src/lib/gssapi/mechglue/g_dup_name.c
index bf6eb602e..8134457a4 100644
--- a/src/lib/gssapi/mechglue/g_dup_name.c
+++ b/src/lib/gssapi/mechglue/g_dup_name.c
@@ -55,7 +55,7 @@ gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t src_name,
gss_name_t *dest_name)
{
gss_union_name_t src_union, dest_union;
- OM_uint32 major_status = GSS_S_FAILURE;
+ OM_uint32 major_status = GSS_S_FAILURE, tmp;
major_status = val_dup_name_args(minor_status, src_name, dest_name);
if (major_status != GSS_S_COMPLETE)
@@ -120,8 +120,8 @@ gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t src_name,
allocation_failure:
if (dest_union) {
if (dest_union->external_name) {
- if (dest_union->external_name->value)
- free(dest_union->external_name->value);
+ (void) gss_release_buffer(&tmp,
+ dest_union->external_name);
free(dest_union->external_name);
}
if (dest_union->name_type)
diff --git a/src/lib/gssapi/mechglue/g_imp_name.c b/src/lib/gssapi/mechglue/g_imp_name.c
index 65fa6c0fb..be41add2b 100644
--- a/src/lib/gssapi/mechglue/g_imp_name.c
+++ b/src/lib/gssapi/mechglue/g_imp_name.c
@@ -158,8 +158,7 @@ gss_import_name(OM_uint32 * minor_status, gss_buffer_t input_name_buffer,
allocation_failure:
if (union_name) {
if (union_name->external_name) {
- if (union_name->external_name->value)
- free(union_name->external_name->value);
+ (void) gss_release_buffer(&tmp, union_name->external_name);
free(union_name->external_name);
}
if (union_name->name_type)
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
