Fix double free in kdc hammer

If kdc5_hammer.c:krb5_string_to_key() fails, we didn't NULL out key
before returning it, leading to potential double-free.

diff --git a/src/tests/hammer/kdc5_hammer.c b/src/tests/hammer/kdc5_hammer.c
index efb4271e587c5162e6557a34a46156ed6b21cf05..086c21d1ce3eed66100357b21e6d448a3c5af515 100644 (file)
--- a/src/tests/hammer/kdc5_hammer.c
+++ b/src/tests/hammer/kdc5_hammer.c
@@ -283,6 +283,8 @@ get_server_key(context, server, enctype, key)
     krb5_data salt;
     krb5_data pwd;
 
+    *key = NULL;
+
     if ((retval = krb5_principal2salt(context, server, &salt)))
        return retval;
 
@@ -294,8 +296,11 @@ get_server_key(context, server, enctype, key)
 
     if ((*key = (krb5_keyblock *)malloc(sizeof(krb5_keyblock)))) {
        krb5_use_enctype(context, &eblock, enctype);
-       if ((retval = krb5_string_to_key(context, &eblock, *key, &pwd, &salt)))
+       retval = krb5_string_to_key(context, &eblock, *key, &pwd, &salt);
+       if (retval) {
            free(*key);
+           *key = NULL;
+       }
     } else
         retval = ENOMEM;