[18878] in Kerberos_V5_Development
Re: krb5_free_data
daemon@ATHENA.MIT.EDU (Markus Moeller)
Sun Jun 22 08:07:48 2014
To: krbdev@mit.edu
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Sun, 22 Jun 2014 13:04:59 +0100
Message-ID: <lo6gpd$mqr$1@ger.gmane.org>
Mime-Version: 1.0
X-Complaints-To: usenet@ger.gmane.org
In-Reply-To: <ldvvbrterem.fsf@sarnath.mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi Tom,
I see. So if k5_pac_locate_buffer returns with an error I may get this
problem ?
krb5_error_code KRB5_CALLCONV
krb5_pac_get_buffer(krb5_context context,
krb5_pac pac,
krb5_ui_4 type,
krb5_data *data)
{
krb5_data d;
krb5_error_code ret;
ret = k5_pac_locate_buffer(context, pac, type, &d);
if (ret != 0)
return ret;
data->data = malloc(d.length);
if (data->data == NULL)
return ENOMEM;
...
Thank you
Markus
"Tom Yu" wrote in message news:ldvvbrterem.fsf@sarnath.mit.edu...
Markus Moeller <huaraz@moeller.plus.com> writes:
> (gdb) where
> #0 0x00007ffff5f911b5 in *__GI_raise (sig=<value optimized out>) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #1 0x00007ffff5f93fc0 in *__GI_abort () at abort.c:92
> #2 0x00007ffff5fc75bb in __libc_message (do_abort=<value optimized out>,
> fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
> #3 0x00007ffff5fd0e16 in malloc_printerr (action=3, str=0x7ffff6088748
> "double free or corruption (fasttop)", ptr=<value optimized out>)
> at malloc.c:6267
> #4 0x00007ffff5fd5b8c in *__GI___libc_free (mem=<value optimized out>) at
> malloc.c:3739
> #5 0x00007ffff7939472 in krb5_free_data (context=<value optimized out>,
> val=0x6171f0) at ../../../../src/lib/krb5/krb/kfree.c:253
> #6 0x00000000004051a4 in get_ad_groups (ad_groups=0x7fffffffaff0 "",
> context=0x60f9e0, pac=0x0) at negotiate_kerberos_pac.cc:464
> #7 0x0000000000403265 in main (argc=5, argv=0x7fffffffe0e8) at
> negotiate_kerberos_auth.cc:419
>
> and line 253 is free(val->data)
>
> The code I have is the following and I get an error in
> krb5_pac_get_buffer:
> Invalid argument
>
>
> ad_data = (krb5_data *)xmalloc(sizeof(krb5_data));
>
> #define KERB_LOGON_INFO 1
> ret = krb5_pac_get_buffer(context, pac, KERB_LOGON_INFO, ad_data);
> if (check_k5_err(context, "krb5_pac_get_buffer", ret))
> goto k5clean;
>
>
> k5clean:
> krb5_free_data(context, ad_data);
>
> Maybe there is something wrong. I usually do not get this error, but I
> don't
> know why it happens sometimes.
It appears that krb5_pac_get_buffer() does not initialize its output
parameter on error conditions. This is probably a bug. As a
workaround, consider using calloc() to allocate ad_data so that the
pointer gets initialized to NULL.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
