[2395] in Kerberos-V5-bugs
pending/150: krb524d frees memory twice
daemon@ATHENA.MIT.EDU (John Gardiner Myers)
Sun Nov 3 13:41:06 1996
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: gnats-admin@rt-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU, John Gardiner Myers <jgm@portolacomm.com>
Date: Sun, 3 Nov 1996 10:37:59 -0800 (PST)
From: John Gardiner Myers <jgm@portolacomm.com>
Reply-To: John Gardiner Myers <jgm@portolacomm.com>
To: krb5-bugs@MIT.EDU
>Number: 150
>Category: pending
>Synopsis: krb524d frees memory twice
>Confidential: yes
>Severity: serious
>Priority: medium
>Responsible: gnats-admin
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Sun Nov e 13:41:00 EST 1996
>Last-Modified:
>Originator:
>Organization:
>Release:
>Environment:
>Description:
>How-To-Repeat:
>Fix:
>Audit-Trail:
>Unformatted:
In handling a request, krb524d frees some memory twice. Enclosed patch
fixes one instance of this.
I also noticed that in the first failrue
condition, krb624_convert_tkt_skey() frees the input v5tkt, but does
not do so in any of the other error cases. This call to
krb5_free_ticket() is probably incorrect.
RCS file: /usr/system/portola/cvsroot/security/krb5/src/krb524/krb524d.c,v
retrieving revision 1.1.1.1
diff -c -r1.1.1.1 krb524d.c
*** krb524d.c 1996/11/02 20:54:30 1.1.1.1
--- krb524d.c 1996/11/03 17:33:30
***************
*** 291,299 ****
&v4_service_key);
if (ret)
goto error;
- krb5_free_keyblock_contents(context, &v5_service_key);
- krb5_free_keyblock_contents(context, &v4_service_key);
- krb5_free_ticket(context, v5tkt);
if (debug)
printf("credentials converted\n");
--- 291,296 ----
