Checked in rest of Jim Miller's kadmin bugs krb5-bugs [0395]

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@3915 dc483132-0cff-0310-8789-dd5450dbe970

5 files changed, 18 insertions, 8 deletions

diff --git a/src/kadmin/client/ChangeLog b/src/kadmin/client/ChangeLog
new file mode 100644
index 000000000..56454bad2
--- /dev/null
+++ b/src/kadmin/client/ChangeLog
@@ -0,0 +1,5 @@
+Fri Jun 24 22:48:29 1994  Theodore Y. Ts'o  (tytso at tsx-11)
+
+	* kadmin_done (kadm_done): fix memory allocation bugs
+
+
diff --git a/src/kadmin/client/kadmin_cpw.c b/src/kadmin/client/kadmin_cpw.c
index fc67d2189..f12480edc 100644
--- a/src/kadmin/client/kadmin_cpw.c
+++ b/src/kadmin/client/kadmin_cpw.c
@@ -119,6 +119,7 @@ char *principal;
 
     /* write private message to server */
     if (krb5_write_message(local_socket, &msg_data)){
+	free(msg_data.data);
         fprintf(stderr, "Write Error During Second Message Transmission!\n");
         return(1);
     } 
@@ -154,6 +155,8 @@ char *principal;
 	    free(rd_priv_resp.message);
 	} else
 	    fprintf(stderr, "Generic error from server.\n\n");
+	memset(msg_data.data, 0, msg_data.length);
+	free(msg_data.data);
         return(0);
     }
 
@@ -167,6 +170,8 @@ char *principal;
     pwsize = msg_data.length;
     if ((password = (char *) calloc (1, pwsize)) == (char *) 0) {
         fprintf(stderr, "No Memory for allocation of password!\n");
+	memset(msg_data.data, 0, msg_data.length);
+	free(msg_data.data);
         return(1);
     }
 
diff --git a/src/kadmin/client/kadmin_del.c b/src/kadmin/client/kadmin_del.c
index 8a021d53a..a2d83673d 100644
--- a/src/kadmin/client/kadmin_del.c
+++ b/src/kadmin/client/kadmin_del.c
@@ -112,6 +112,7 @@ char *principal;
 
     /* write private message to server */
     if (krb5_write_message(local_socket, &msg_data)){
+	free(msg_data.data);
         fprintf(stderr, "Write Error During Second Message Transmission!\n");
         return(1);
     } 
diff --git a/src/kadmin/client/kadmin_done.c b/src/kadmin/client/kadmin_done.c
index 08ad01812..8655f5dce 100644
--- a/src/kadmin/client/kadmin_done.c
+++ b/src/kadmin/client/kadmin_done.c
@@ -51,12 +51,9 @@ krb5_int32 *seqno;
 {
     krb5_data msg_data, inbuf;
     krb5_error_code retval;     /* return code */
+    char buf[16];
 
-    /* XXX 755 was sizeof( char username[755]) */
-    if ((inbuf.data = (char *) calloc(1, 8 + 755)) == (char *) 0) {
-	fprintf(stderr, "No memory for command!\n");
-	exit(1);
-    }
+    inbuf.data = buf;
 
     inbuf.data[0] = KADMIN;
     inbuf.data[1] = COMPLETE;
@@ -79,10 +76,10 @@ krb5_int32 *seqno;
 			error_message(retval));
         return(1);
     }
-    free(inbuf.data);
 
     /* write private message to server */
-    if (krb5_write_message(local_socket, &msg_data)){
+    if (krb5_write_message(local_socket, &msg_data)) {
+	free(msg_data.data);
         fprintf(stderr, "Write Error During Second Message Transmission!\n");
         return(1);
     } 
diff --git a/src/kadmin/client/kadmin_mod.c b/src/kadmin/client/kadmin_mod.c
index 7e773d793..0d895b0bb 100644
--- a/src/kadmin/client/kadmin_mod.c
+++ b/src/kadmin/client/kadmin_mod.c
@@ -139,7 +139,6 @@ char *principal;
         return(1);
     }
     free(inbuf.data);
-    free(msg_data.data);
 
     if (msg_data.data[2] == KADMBAD) {
 	decode_kadmind_reply(msg_data, &rd_priv_resp);
@@ -149,8 +148,10 @@ char *principal;
 	    free(rd_priv_resp.message);
 	} else
 	    fprintf(stderr, "Generic error from server.\n\n");
+	free(msg_data.data);
         return(0);
     }
+    free(msg_data.data);
 
     kadm_snd_mod(my_creds, rep_ret, local_addr, 
 			foreign_addr, local_socket, seqno);
@@ -186,6 +187,7 @@ char *principal;
          /* write private message to server */
     if (krb5_write_message(local_socket, &msg_data)){
         fprintf(stderr, "Write Error During Second Message Transmission!\n");
+	free(msg_data.data);
         return(1);
     }
     free(msg_data.data);