Author: ngie Date: Fri Jun 10 14:48:10 2016 New Revision: 301792 URL: https://svnweb.freebsd.org/changeset/base/301792
Log: MFC r299495: r299495 (by cem): libkrb5: Fix potential double-free If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed memory and then be double-freed. After freeing it the first time, initialize it to NULL, which causes subsequent krb5_free_principal calls to do the right thing. CID: 1273430 Modified: stable/10/crypto/heimdal/lib/krb5/get_cred.c Directory Properties: stable/10/ (props changed) Modified: stable/10/crypto/heimdal/lib/krb5/get_cred.c ============================================================================== --- stable/10/crypto/heimdal/lib/krb5/get_cred.c Fri Jun 10 14:45:20 2016 (r301791) +++ stable/10/crypto/heimdal/lib/krb5/get_cred.c Fri Jun 10 14:48:10 2016 (r301792) @@ -831,6 +831,7 @@ get_cred_kdc_capath_worker(krb5_context if(strcmp(tgt_inst, server_realm) == 0) break; krb5_free_principal(context, tmp_creds.server); + tmp_creds.server = NULL; ret = krb5_make_principal(context, &tmp_creds.server, tgt_inst, KRB5_TGS_NAME, server_realm, NULL); if(ret) { _______________________________________________ svn-src-stable-10@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10 To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"