From: Andreas Schneider <asn@samba.org>
Date: Tue, 15 Oct 2024 06:51:43 +0000 (+0200)
Subject: nsswitch: Fix memory leak in wbinfo_auth_krb5()
X-Git-Tag: tdb-1.4.13~865
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6a1196c5677519d6280a9f01149eb8a01ca106bd;p=thirdparty%2Fsamba.git

nsswitch: Fix memory leak in wbinfo_auth_krb5()

Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x7ff206afc130 in calloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:77
    #1 0x7ff206837054 in wbcAllocateMemory ../../nsswitch/libwbclient/wbclient.c:216
    #2 0x7ff20683c76a in wbc_create_password_policy_info ../../nsswitch/libwbclient/wbc_pam.c:295
    #3 0x7ff20683c76a in wbcCtxLogonUser ../../nsswitch/libwbclient/wbc_pam.c:1290
    #4 0x7ff20683caec in wbcLogonUser ../../nsswitch/libwbclient/wbc_pam.c:1307
    #5 0x556ea348db12 in wbinfo_auth_krb5 ../../nsswitch/wbinfo.c:1723
    #6 0x556ea348db12 in main ../../nsswitch/wbinfo.c:3238
    #7 0x7ff203c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
---

diff --git a/nsswitch/wbinfo.c b/nsswitch/wbinfo.c
index 6148b204043..87053fac9a7 100644
--- a/nsswitch/wbinfo.c
+++ b/nsswitch/wbinfo.c
@@ -1656,9 +1656,9 @@ static bool wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
 	char *local_cctype = NULL;
 	uid_t uid;
 	struct wbcLogonUserParams params;
-	struct wbcLogonUserInfo *info;
-	struct wbcAuthErrorInfo *error;
-	struct wbcUserPasswordPolicyInfo *policy;
+	struct wbcLogonUserInfo *info = NULL;
+	struct wbcAuthErrorInfo *error = NULL;
+	struct wbcUserPasswordPolicyInfo *policy = NULL;
 	TALLOC_CTX *frame = talloc_tos();
 
 	if ((s = talloc_strdup(frame, username)) == NULL) {
@@ -1762,7 +1762,9 @@ static bool wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
 		}
 	}
  done:
-
+	wbcFreeMemory(error);
+	wbcFreeMemory(policy);
+	wbcFreeMemory(info);
 	wbcFreeMemory(params.blobs);
 
 	return WBC_ERROR_IS_OK(wbc_status);