In pkinit_crypto_openssl.c, modified pkinit_octetstring2key() to

eliminate a possible memory leak in the error path, where the
key_block->length was set to zero but the key_block->contents were
not freed.  Also, changed calloc() call to a malloc() call to avoid
allocating up to 8 times as much buffer space as needed.

In keyblocks.c, modified kr5_free_keyblock_contents() to set the
key->length to zero after the key->contents have been freed.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25189 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 4 insertions, 4 deletions

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 4247524ae5..6f7023f700 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2143,7 +2143,7 @@ pkinit_octetstring2key(krb5_context context,
         goto cleanup;
 
     key_block->length = keylength;
-    key_block->contents = calloc(keylength, sizeof(unsigned char *));
+    key_block->contents = malloc(keylength);
     if (key_block->contents == NULL) {
         retval = ENOMEM;
         goto cleanup;
@@ -2156,9 +2156,9 @@ pkinit_octetstring2key(krb5_context context,
 
 cleanup:
     free(buf);
-    if (retval && key_block->contents != NULL && key_block->length != 0) {
-        memset(key_block->contents, 0, key_block->length);
-        key_block->length = 0;
+    // If this is an error return, free the allocated keyblock, if any
+    if (retval) {
+        krb5_free_keyblock_contents(context, key_block);
     }
 
     return retval;