Skip to content

Commit

Permalink
libkrb5: Fix potential double-free
Browse files Browse the repository at this point in the history
If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed
memory and then be double-freed.  After freeing it the first time, initialize
it to NULL, which causes subsequent krb5_free_principal calls to do the right
thing.

Reported by:	Coverity
CID:		1273430
Sponsored by:	EMC / Isilon Storage Division
  • Loading branch information
cemeyer committed May 11, 2016
1 parent fe4be61 commit f74fc68
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions crypto/heimdal/lib/krb5/get_cred.c
Original file line number Diff line number Diff line change
Expand Up @@ -831,6 +831,7 @@ get_cred_kdc_capath_worker(krb5_context context,
if(strcmp(tgt_inst, server_realm) == 0)
break;
krb5_free_principal(context, tmp_creds.server);
tmp_creds.server = NULL;
ret = krb5_make_principal(context, &tmp_creds.server,
tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
if(ret) {
Expand Down

0 comments on commit f74fc68

Please sign in to comment.