* accept_sec_context.c (krb5_gss_accept_sec_context): Free authdat

	even on success to avoid a memory leak.

	* util_cksum.c (kg_checksum_channel_bindings): Fix memory leak by
 	not allocating cksum->contents unless we have to return a
 	zero-filled one.

	* k5unseal.c (kg_unseal_v1): Fix memorly leak by not allocating
	md5cksum.contents.

	* k5seal.c (make_seal_token_v1): Fix memory leak by not allocating
	md5cksum.contents.

	* accept_sec_context.c (krb5_gss_accept_sec_context): Only free
	ap_req.data if it was allocated by kg2_parse_token(), otherwise we
	lose very badly trying to free the middle of a potentially
	malloc()'ed block, possibly coredumping.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10927 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/gssapi/krb5/ChangeLog b/src/lib/gssapi/krb5/ChangeLog
index 156ef4e3a70d6834ea2dae1593bccccff029b3bc..d0bd8a8fc1bc5692924d33a11fc121af9f09566a 100644 (file)
--- a/src/lib/gssapi/krb5/ChangeLog
+++ b/src/lib/gssapi/krb5/ChangeLog
@@ -1,5 +1,18 @@
 Mon Sep 21 00:32:28 1998  Tom Yu  <tlyu@mit.edu>
 
+       * accept_sec_context.c (krb5_gss_accept_sec_context): Free authdat
+       even on success to avoid a memory leak.
+
+       * util_cksum.c (kg_checksum_channel_bindings): Fix memory leak by
+       not allocating cksum->contents unless we have to return a
+       zero-filled one.
+
+       * k5unseal.c (kg_unseal_v1): Fix memorly leak by not allocating
+       md5cksum.contents.
+
+       * k5seal.c (make_seal_token_v1): Fix memory leak by not allocating
+       md5cksum.contents.
+
        * accept_sec_context.c (krb5_gss_accept_sec_context): Only free
        ap_req.data if it was allocated by kg2_parse_token(), otherwise we
        lose very badly trying to free the middle of a potentially

diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index 011016f41b46d0cb5b0ab116dac88b3c90ce3c25..efd3f7d06e420ec12106754f50db9b89a1d8fe2e 100644 (file)
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -902,6 +902,8 @@ krb5_gss_accept_sec_context(minor_status, context_handle,
 
    /* finally! */
 
+   if (authdat)
+       krb5_free_authenticator(context, authdat);
    *minor_status = 0;
    return(GSS_S_COMPLETE);
 

diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c
index 96f253035e0b0f31584e11d8ae55833398c9f70c..57e149a51fe7436693d7e2bf91f1a1bcc8c983af 100644 (file)
--- a/src/lib/gssapi/krb5/k5seal.c
+++ b/src/lib/gssapi/krb5/k5seal.c
@@ -326,29 +326,24 @@ make_seal_token_v1(context, enc, seq, seqnum, direction, text, token,
 
    /* pad the plaintext, encrypt if needed, and stick it in the token */
 
-   /* initialize the the cksum and allocate the contents buffer */
+   /* initialize the the cksum */
    if (code = krb5_c_checksum_length(context, CKSUMTYPE_RSA_MD5, &sumlen))
        return(code);
 
    md5cksum.checksum_type = CKSUMTYPE_RSA_MD5;
    md5cksum.length = sumlen;
-   if ((md5cksum.contents = (krb5_octet *) xmalloc(md5cksum.length)) == NULL)
-      return(ENOMEM);
- 
    if (toktype == KG_TOK_SEAL_MSG) {
       unsigned char *plain;
       unsigned char pad;
 
       if (!bigend || encrypt) {
         if ((plain = (unsigned char *) xmalloc(tmsglen)) == NULL) {
-           xfree(md5cksum.contents);
            xfree(t);
            return(ENOMEM);
         }
 
         if ((code = kg_make_confounder(context, enc, plain))) {
            xfree(plain);
-           xfree(md5cksum.contents);
            xfree(t);
            return(code);
         }
@@ -370,7 +365,6 @@ make_seal_token_v1(context, enc, seq, seqnum, direction, text, token,
                                tmsglen))) {
            if (plain)
               xfree(plain);
-           xfree(md5cksum.contents);
            xfree(t);
            return(code);
         }
@@ -388,7 +382,6 @@ make_seal_token_v1(context, enc, seq, seqnum, direction, text, token,
             (char *) xmalloc(8 + (bigend ? text->length : tmsglen)))) {
          if (plain)
              xfree(plain);
-         xfree(md5cksum.contents);
          xfree(t);
          return(ENOMEM);
       }
@@ -406,7 +399,6 @@ make_seal_token_v1(context, enc, seq, seqnum, direction, text, token,
       if (code) {
          if (plain)
              xfree(plain);
-         xfree(md5cksum.contents);
          xfree(t);
          return(code);
          memcpy(ptr+14+cksum_size, plain, tmsglen);
@@ -418,7 +410,6 @@ make_seal_token_v1(context, enc, seq, seqnum, direction, text, token,
       /* compute the checksum */
 
       if (! (data_ptr = (char *) xmalloc(8 + text->length))) {
-         xfree(md5cksum.contents);
          xfree(t);
          return(ENOMEM);
       }
@@ -430,7 +421,6 @@ make_seal_token_v1(context, enc, seq, seqnum, direction, text, token,
                                  &plaind, &md5cksum);
       xfree(data_ptr);
       if (code) {
-         xfree(md5cksum.contents);
          xfree(t);
          return(code);
       }

diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c
index 03ca9ef7ca6021e315128b3712cd67cc1f11945d..28385bb3a8f4227f16271b22e757331979c1378b 100644 (file)
--- a/src/lib/gssapi/krb5/k5unseal.c
+++ b/src/lib/gssapi/krb5/k5unseal.c
@@ -558,18 +558,12 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
 
    /* compute the checksum of the message */
 
-   /* initialize the the cksum and allocate the contents buffer */
+   /* initialize the the cksum */
    if (code = krb5_c_checksum_length(context, CKSUMTYPE_RSA_MD5, &sumlen))
        return(code);
 
    md5cksum.checksum_type = CKSUMTYPE_RSA_MD5;
    md5cksum.length = sumlen;
-   if ((md5cksum.contents = (krb5_octet *) xmalloc(md5cksum.length)) == NULL) {
-      if (sealalg != 0xffff)
-        xfree(plain);
-      *minor_status = ENOMEM;
-      return(GSS_S_FAILURE);
-   }
 
    switch (signalg) {
    case 0:
@@ -580,7 +574,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
 
       if (! (data_ptr = (void *)
             xmalloc(8 + (ctx->big_endian ? token.length : plainlen)))) {
-         xfree(md5cksum.contents);
          if (sealalg != 0xffff)
              xfree(plain);
          if (toktype == KG_TOK_SEAL_MSG)
@@ -603,7 +596,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
       xfree(data_ptr);
 
       if (code) {
-         xfree(md5cksum.contents);
          if (toktype == KG_TOK_SEAL_MSG)
              xfree(token.value);
          *minor_status = code;
@@ -698,12 +690,12 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
       plaind.length = 8 + sizeof(ctx->seed) +
          (ctx->big_endian ? token.length : plainlen);
       plaind.data = data_ptr;
+      xfree(md5cksum.contents);
       code = krb5_c_make_checksum(context, md5cksum.checksum_type, 0, 0,
                                  &plaind, &md5cksum);
       xfree(data_ptr);
 
       if (code) {
-         xfree(md5cksum.contents);
          if (sealalg == 0)
              xfree(plain);
          if (toktype == KG_TOK_SEAL_MSG)

diff --git a/src/lib/gssapi/krb5/util_cksum.c b/src/lib/gssapi/krb5/util_cksum.c
index d9ce3bf4364209e6d914fa7d4f48c10eeb010e48..b3e6b6cbc540d04eb8c086ce4a25fa8079914fe7 100644 (file)
--- a/src/lib/gssapi/krb5/util_cksum.c
+++ b/src/lib/gssapi/krb5/util_cksum.c
@@ -40,21 +40,21 @@ kg_checksum_channel_bindings(context, cb, cksum, bigend)
    krb5_data plaind;
    krb5_error_code code;
 
-   /* initialize the the cksum and allocate the contents buffer */
+   /* initialize the the cksum */
    if (code = krb5_c_checksum_length(context, CKSUMTYPE_RSA_MD5, &sumlen))
        return(code);
 
    cksum->checksum_type = CKSUMTYPE_RSA_MD5;
    cksum->length = sumlen;
-   if ((cksum->contents = (krb5_octet *) xmalloc(cksum->length)) == NULL) {
-      return(ENOMEM);
-   }
  
    /* generate a buffer full of zeros if no cb specified */
 
    if (cb == GSS_C_NO_CHANNEL_BINDINGS) {
-      memset(cksum->contents, '\0', cksum->length);
-      return(0);
+       if ((cksum->contents = (krb5_octet *) xmalloc(cksum->length)) == NULL) {
+          return(ENOMEM);
+       }
+       memset(cksum->contents, '\0', cksum->length);
+       return(0);
    }
 
    /* create the buffer to checksum into */