[4060] in Kerberos-V5-bugs
[krbdev.mit.edu #1408] krb5_rc_dfl_expunge() bug
daemon@ATHENA.MIT.EDU (Mike Eisler via RT)
Thu Apr 3 13:56:46 2003
Date: Thu, 3 Apr 2003 13:56:33 -0500 (EST)
Message-Id: <rt-1408-5611.8.38116222042075@krbdev.mit.edu>
In-Reply-To: <rt-1408@krbdev.mit.edu>
From: "Mike Eisler via RT" <rt-comment@krbdev.mit.edu>
To: krb5-prs@mit.edu
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
This is in rc_dfl.c ... the bug is still in the 1.3 code I downloaded today.
krb5_error_code KRB5_CALLCONV
krb5_rc_dfl_expunge(krb5_context context, krb5_rcache id)
{
struct dfl_data *t = (struct dfl_data *)id->data;
#ifdef NOIOSTUFF
int i;
struct authlist **q;
struct authlist **qt;
struct authlist *r;
struct authlist *rt;
for (q = &t->a; *q; q = qt) {
qt = &(*q)->na;
if (alive(context, &(*q)->rep, t->lifespan) == CMP_EXPIRED) {
FREE((*q)->rep.client);
FREE((*q)->rep.server);
FREE(*q);
*q = *qt; /* why doesn't this feel right? */
}
}
The comment "why doesn't this fell right?" is prophetic.
qt is &(*q)->qt, os *qt is refering to the (*q)->qt.
points to *q->na. However, *q was freed in the previous
statement. At that point, the memory allocator is free to
step on what *q pointed to, including *q->na. So in
some allocators (such as the one used by Network Appliance),
*q->na is now modified.
I think simply saving *qt into a temporary before
the FREE(*q) is the solution:
r = *qt;
FREE(*q);
*q = r;
but the entire loop makes my brain hurt, and
I've chosen to re-write it using vairables named curr, prev, and
next, each of type authlist *.
BTW, I noticed that rep.magic is always 128, but I cannot
find where it gets set to 128.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
