From 4ff3d0e74b4674478fb86019f78f931fa9c8567e Mon Sep 17 00:00:00 2001 From: ngie Date: Fri, 10 Jun 2016 14:48:10 +0000 Subject: [PATCH] MFC r299495: r299495 (by cem): libkrb5: Fix potential double-free If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed memory and then be double-freed. After freeing it the first time, initialize it to NULL, which causes subsequent krb5_free_principal calls to do the right thing. CID: 1273430 git-svn-id: svn://svn.freebsd.org/base/stable/10@301792 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- crypto/heimdal/lib/krb5/get_cred.c | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/heimdal/lib/krb5/get_cred.c b/crypto/heimdal/lib/krb5/get_cred.c index e3bb23a2e..9914fe424 100644 --- a/crypto/heimdal/lib/krb5/get_cred.c +++ b/crypto/heimdal/lib/krb5/get_cred.c @@ -831,6 +831,7 @@ get_cred_kdc_capath_worker(krb5_context context, if(strcmp(tgt_inst, server_realm) == 0) break; krb5_free_principal(context, tmp_creds.server); + tmp_creds.server = NULL; ret = krb5_make_principal(context, &tmp_creds.server, tgt_inst, KRB5_TGS_NAME, server_realm, NULL); if(ret) { -- 2.45.0