diff options
| author | Greg Hudson <ghudson@mit.edu> | 2014-03-13 18:34:22 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2014-03-18 13:01:13 -0400 |
| commit | cc002d6c1ccfc08356d01ba83e72a46855d0302c (patch) | |
| tree | 2394f2f6bf646f84a57ba5997cc3494d08ca3e84 | |
| parent | cb3db58b1942998a5e2c4d46c21ca0554e769a8c (diff) | |
| download | krb5-cc002d6c1ccfc08356d01ba83e72a46855d0302c.tar.gz krb5-cc002d6c1ccfc08356d01ba83e72a46855d0302c.tar.xz krb5-cc002d6c1ccfc08356d01ba83e72a46855d0302c.zip | |
Fix unlikely double free in PKINIT client code
In pa_pkinit_gen_req, if the cleanup handler is reached with non-zero
retval and non-null out_data, out_data is freed, then dereferenced,
then freed again. This can only happen if one of the small fixed-size
malloc requests fails after pkinit_as_req_create succeeds, so it is
unlikely to occur in practice.
ticket: 7878 (new)
target_version: 1.12.2
tags: pullup
| -rw-r--r-- | src/plugins/preauth/pkinit/pkinit_clnt.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c index bfa25ae61..cfef5b9dc 100644 --- a/src/plugins/preauth/pkinit/pkinit_clnt.c +++ b/src/plugins/preauth/pkinit/pkinit_clnt.c @@ -212,7 +212,6 @@ pa_pkinit_gen_req(krb5_context context, cleanup: if (der_req != NULL) krb5_free_data(context, der_req); - free(out_data); if (retval) { if (return_pa_data) { @@ -222,9 +221,9 @@ cleanup: } if (out_data) { free(out_data->data); - free(out_data); } } + free(out_data); return retval; } |