diff options
| author | Tomas Kuthan <tkuthan@gmail.com> | 2014-03-26 17:04:30 +0100 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2014-03-27 11:42:11 -0400 |
| commit | b24c362f0589a6212f2f544263bdb76e0988c582 (patch) | |
| tree | 4d07a9f882eee3f9e5e999d191430804cddf461d /src/patchlevel.h | |
| parent | 54c97cd0c435f78880d80541a20cf7f08928705d (diff) | |
| download | krb5-b24c362f0589a6212f2f544263bdb76e0988c582.tar.gz krb5-b24c362f0589a6212f2f544263bdb76e0988c582.tar.xz krb5-b24c362f0589a6212f2f544263bdb76e0988c582.zip | |
Don't free cred handle used in kadm5 server handle
At the end of setup_gss(), gss_client_creds is released, but an alias
to the credential handle is saved in kadm5_server_handle_t in
handle->clnt->cl_auth->(struct rpc_gss_data *)ah_private->sec.cred.
Accessing these credentials (by authgss_refresh) can result in use
after free.
This fix stores credential reference in server handle and releases
the credentials in kadm5_destroy.
[ghudson@mit.edu: initialize handle->cred to correct constant; get rid
of gss_client_creds variable; clarify commit message slightly]
ticket: 7891 (new)
Diffstat (limited to 'src/patchlevel.h')
0 files changed, 0 insertions, 0 deletions