gssalloc memory management for gss_buffer_set

compiles, but untested

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25341 dc483132-0cff-0310-8789-dd5450dbe970

3 files changed, 26 insertions, 9 deletions

diff --git a/src/lib/gssapi/generic/gssapi_alloc.h b/src/lib/gssapi/generic/gssapi_alloc.h
index cccbdbb4c4..a192124666 100644
--- a/src/lib/gssapi/generic/gssapi_alloc.h
+++ b/src/lib/gssapi/generic/gssapi_alloc.h
@@ -48,6 +48,16 @@ gssalloc_calloc(size_t count, size_t size)
 #endif
 }
 
+static inline void *
+gssalloc_realloc(void *value, size_t size)
+{
+#if _WIN32
+    return HeapReAlloc(GetProcessHeap(), 0, value, size);
+#else
+    return realloc(value, size);
+#endif
+}
+
 static inline char *
 gssalloc_strdup(const char *str)
 {
diff --git a/src/lib/gssapi/generic/util_buffer_set.c b/src/lib/gssapi/generic/util_buffer_set.c
index 46ec66cc9d..5cc3e15dc1 100644
--- a/src/lib/gssapi/generic/util_buffer_set.c
+++ b/src/lib/gssapi/generic/util_buffer_set.c
@@ -38,7 +38,7 @@ generic_gss_create_empty_buffer_set(OM_uint32 * minor_status,
 {
     gss_buffer_set_t set;
 
-    set = (gss_buffer_set_desc *) malloc(sizeof(*set));
+    set = (gss_buffer_set_desc *) gssalloc_malloc(sizeof(*set));
     if (set == GSS_C_NO_BUFFER_SET) {
         *minor_status = ENOMEM;
         return GSS_S_FAILURE;
@@ -71,7 +71,7 @@ generic_gss_add_buffer_set_member(OM_uint32 * minor_status,
     }
 
     set = *buffer_set;
-    set->elements = (gss_buffer_desc *)realloc(set->elements,
+    set->elements = (gss_buffer_desc *)gssalloc_realloc(set->elements,
                                                (set->count + 1) *
                                                sizeof(gss_buffer_desc));
     if (set->elements == NULL) {
@@ -81,7 +81,7 @@ generic_gss_add_buffer_set_member(OM_uint32 * minor_status,
 
     p = &set->elements[set->count];
 
-    p->value = malloc(member_buffer->length);
+    p->value = gssalloc_malloc(member_buffer->length);
     if (p->value == NULL) {
         *minor_status = ENOMEM;
         return GSS_S_FAILURE;
@@ -113,13 +113,13 @@ generic_gss_release_buffer_set(OM_uint32 * minor_status,
     }
 
     if ((*buffer_set)->elements != NULL) {
-        free((*buffer_set)->elements);
+        gssalloc_free((*buffer_set)->elements);
         (*buffer_set)->elements = NULL;
     }
 
     (*buffer_set)->count = 0;
 
-    free(*buffer_set);
+    gssalloc_free(*buffer_set);
     *buffer_set = GSS_C_NO_BUFFER_SET;
 
     return GSS_S_COMPLETE;
diff --git a/src/lib/gssapi/krb5/naming_exts.c b/src/lib/gssapi/krb5/naming_exts.c
index f6c02e870e..9d66df38b2 100644
--- a/src/lib/gssapi/krb5/naming_exts.c
+++ b/src/lib/gssapi/krb5/naming_exts.c
@@ -231,15 +231,22 @@ kg_data_list_to_buffer_set_nocopy(krb5_data **pdata,
         ;
 
     set->count = i;
-    set->elements = calloc(i, sizeof(gss_buffer_desc));
+    set->elements = gssalloc_calloc(i, sizeof(gss_buffer_desc));
     if (set->elements == NULL) {
         gss_release_buffer_set(&minor_status, &set);
         return ENOMEM;
     }
 
-    for (i = 0; i < set->count; i++) {
-        set->elements[i].length = data[i].length;
-        set->elements[i].value = data[i].data;
+    /*
+     * Copy last element first so data remains properly
+     * NULL-terminated in case of allocation failure
+     * in data_to_gss() on windows.
+     */
+    for (i = set->count-1; i >= 0; i--) {
+        if (data_to_gss(&data[i], &set->elements[i])) {
+            gss_release_buffer_set(&minor_status, &set);
+            return ENOMEM;
+        }
     }
 
     free(data);