Fix rare leak in krb5_cccol_have_content()

If krb5_cc_start_seq_get() fails inside the loop, close the current
credential cache before continuing to the next one.  Reported by Todd
Lipcon.

(cherry picked from commit 1735f2e74767e56ac3bd75de61d41b8363ec6ce4)

ticket: 8509
version_fixed: 1.15

diff --git a/src/lib/krb5/ccache/cccursor.c b/src/lib/krb5/ccache/cccursor.c
index 281f1280c4f45d7f34d41dcc64e90dae5f7c8dce..c31a3f5f0b874e9cebf41253a4664059fffbe672 100644 (file)
--- a/src/lib/krb5/ccache/cccursor.c
+++ b/src/lib/krb5/ccache/cccursor.c
@@ -255,8 +255,10 @@ krb5_cccol_have_content(krb5_context context)
 
         ret = krb5_cc_start_seq_get(context, cache, &cache_cursor);
         save_first_error(context, ret, &errsave);
-        if (ret)
+        if (ret) {
+            krb5_cc_close(context, cache);
             continue;
+        }
         while (!found) {
             ret = krb5_cc_next_cred(context, cache, &cache_cursor, &creds);
             save_first_error(context, ret, &errsave);