Fixed memory leak in nsupdate if 'realm' was used multiple times

Resolves: #984687
Signed-off-by: Tomas Hozza <thozza@redhat.com>

1 files changed, 31 insertions, 0 deletions

diff --git a/bind99-ISC-Bugs-35073.patch b/bind99-ISC-Bugs-35073.patch
new file mode 100644
index 0000000..c8be3ed
--- /dev/null
+++ b/bind99-ISC-Bugs-35073.patch
@@ -0,0 +1,31 @@
+diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c

+index 486c102..dc12a85 100644

+--- a/bin/nsupdate/nsupdate.c

++++ b/bin/nsupdate/nsupdate.c

+@@ -1566,16 +1566,20 @@ evaluate_realm(char *cmdline) {

+ #ifdef GSSAPI

+ 	char *word;

+ 	char buf[1024];

++	int n;

+ 

+-	word = nsu_strsep(&cmdline, " \t\r\n");

+-	if (word == NULL || *word == 0) {

+-		if (realm != NULL)

+-			isc_mem_free(mctx, realm);

++	if (realm != NULL) {

++		isc_mem_free(mctx, realm);

+ 		realm = NULL;

+-		return (STATUS_MORE);

+ 	}

+ 

+-	snprintf(buf, sizeof(buf), "@%s", word);

++	word = nsu_strsep(&cmdline, " \t\r\n");

++	if (word == NULL || *word == 0)

++		return (STATUS_MORE);

++

++	n = snprintf(buf, sizeof(buf), "@%s", word);

++	if (n < 0 || (size_t)n >= sizeof(buf))

++		fatal("realm is too long");

+ 	realm = isc_mem_strdup(mctx, buf);

+ 	if (realm == NULL)

+ 		fatal("out of memory");