[3990] in Kerberos-V5-bugs
[krbdev.mit.edu #1203] kinit -k -t segfaults
daemon@ATHENA.MIT.EDU (via RT)
Wed Mar 5 10:48:44 2003
Date: Wed, 5 Mar 2003 10:43:34 -0500 (EST)
Mail-Followup-To: rt@krbdev.mit.edu
Message-Id: <rt-1203-4718.12.3417477560628@krbdev.mit.edu>
In-Reply-To: <rt-1203@krbdev.mit.edu>
From: " via RT" <rt-comment@krbdev.mit.edu>
Mail-Copies-To: never
To: hgm@lanl.gov
cc: krb5-prs@MIT.EDU
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
[hgm@lanl.gov - Fri Oct 4 11:17:08 2002]:
> On Thu, 3 Oct 2002 23:27:24 -0400 (EDT) "Sam Hartman via RT" wrote:
> > Do you believe that patch actually should solve the problem? If so,
> > why/how?
> >
> >
>
> BTW:
>
> With regard to my previous reply to this question, what put
> me on to the patch that seems to fix it for us was that a gdb
> on the core file that results without the patch shows the segfault
> in free(). It segfaults on libc5 linux platforms.
>
> The comment in the patch names the routine where the structure that's
> freed is delcared as a local variable. It seems that freeing local
> variables is asking for trouble.
>
> Harry
Here is an updated patch for the double-free. The old libc5 box I found
did not have any core dumps after applying it.
--- ./src/lib/krb5/krb/gic_keytab.c.LANL_doublefreefix Tue Apr 11
15:43:17 2000+++ ./src/lib/krb5/krb/gic_keytab.c Tue Oct 1 11:55:32
2002
@@ -25,7 +25,13 @@
if (as_key->enctype == etype)
return(0);
- krb5_free_keyblock(context, as_key);
+ /* krb5_free_keyblock frees as_key above and that is a local
+ * variable declaree in krb5_get_init_creds() and used below as
+ * well, so it should NOT be freed, only the contents can be
+ * freed. [Harry G McGavran hgm@lanl.gov]
+ */
+
+ krb5_free_keyblock_contents(context, as_key);
as_key->length = 0;
}
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
