From a44945dfa6502d4cd99943b2448ada389bc22b73 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Sat, 18 Jan 2014 13:03:32 -0500 Subject: Fix gss_pseudo_random leak on zero length output Nobody is likely to ever ask for zero bytes of output from gss_pseudo_random, but if they do, just return an empty buffer without allocating. Otherwise we leak memory because gss_release_buffer doesn't do anything to buffers with length 0. ticket: 7838 (new) --- src/lib/gssapi/krb5/prf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/lib/gssapi/krb5/prf.c b/src/lib/gssapi/krb5/prf.c index a0fbcdab0f..bfca89b4c6 100644 --- a/src/lib/gssapi/krb5/prf.c +++ b/src/lib/gssapi/krb5/prf.c @@ -81,6 +81,9 @@ krb5_gss_pseudo_random(OM_uint32 *minor_status, goto cleanup; } + if (desired_output_len == 0) + return GSS_S_COMPLETE; + prf_out->value = k5alloc(desired_output_len, &code); if (prf_out->value == NULL) { code = KG_INPUT_TOO_LONG; -- cgit