diff options
| author | Greg Hudson <ghudson@mit.edu> | 2011-03-17 22:10:44 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2011-03-17 22:10:44 +0000 |
| commit | 05bccaa5a0d4eba3845fb26a0914ffe891f154ca (patch) | |
| tree | 046e108f903e021c997afaec053c62a7fb207f84 | |
| parent | c2edcfc6afcdc27a007806d48707f6709418eabc (diff) | |
| download | krb5-05bccaa5a0d4eba3845fb26a0914ffe891f154ca.tar.gz krb5-05bccaa5a0d4eba3845fb26a0914ffe891f154ca.tar.xz krb5-05bccaa5a0d4eba3845fb26a0914ffe891f154ca.zip | |
KDC memory leak of reply padata for FAST replies
kdc_fast_response_handle_padata() replaces rep->padata, causing the
old value to be leaked. As a minimal fix, free the old value of
rep->padata before replacing it.
ticket: 6885
target_version: 1.9.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24724 dc483132-0cff-0310-8789-dd5450dbe970
| -rw-r--r-- | src/kdc/fast_util.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c index bc5a77bfa..65e4600b3 100644 --- a/src/kdc/fast_util.c +++ b/src/kdc/fast_util.c @@ -338,6 +338,7 @@ kdc_fast_response_handle_padata(struct kdc_request_state *state, pa[0].length = encrypted_reply->length; pa[0].contents = (unsigned char *) encrypted_reply->data; pa_array[0] = &pa[0]; + krb5_free_pa_data(kdc_context, rep->padata); rep->padata = pa_array; pa_array = NULL; free(encrypted_reply); |