* gc_frm_kdc.c (krb5_get_cred_from_kdc_opt): Cause free_tgt and

	free_otgt to track the states of tgt and otgt correctly, to avoid
	a double-free condition which previously happened when this
	function returned to krb5_get_credentials(), which proceeded to
	free a previously freed TGT in the returned TGT list.

ticket: 3313
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17578 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog
index 90c03df6aa1b1939f63d36ecc232f35abc345ef6..8c91b1a60c8ea7ad8c35406e592bf48cbc0e18e7 100644 (file)
--- a/src/lib/krb5/krb/ChangeLog
+++ b/src/lib/krb5/krb/ChangeLog
@@ -1,3 +1,11 @@
+2005-12-28  Tom Yu  <tlyu@mit.edu>
+
+       * gc_frm_kdc.c (krb5_get_cred_from_kdc_opt): Cause free_tgt and
+       free_otgt to track the states of tgt and otgt correctly, to avoid
+       a double-free condition which previously happened when this
+       function returned to krb5_get_credentials(), which proceeded to
+       free a previously freed TGT in the returned TGT list.
+
 2005-10-19  Ken Raeburn  <raeburn@mit.edu>
 
        * Makefile.in (t_ser): Add dl library and thread link options,

diff --git a/src/lib/krb5/krb/gc_frm_kdc.c b/src/lib/krb5/krb/gc_frm_kdc.c
index 70ca55f4e85b5be3e4dc08a597828bb5f937fb92..a4a0118f6ad912b23f2e505ecb9566e51ec0e1f8 100644 (file)
--- a/src/lib/krb5/krb/gc_frm_kdc.c
+++ b/src/lib/krb5/krb/gc_frm_kdc.c
@@ -230,15 +230,15 @@ krb5_get_cred_from_kdc_opt(krb5_context context, krb5_ccache ccache,
                                              &tgtq.server)))
                goto cleanup;
 
+           if (free_otgt)
+               krb5_free_cred_contents(context, &otgt);
            otgt = tgt;
-           free_otgt = 1;
+           free_otgt = free_tgt;
            free_tgt = 0;
 
            retval = krb5_cc_retrieve_cred(context, ccache, retr_flags,
                                           &tgtq, &tgt);
            if (retval == 0) {
-               krb5_free_cred_contents(context, &otgt);
-               free_otgt = 0;
                free_tgt = 1;
                /* We are now done - proceed to got/finally have tgt */
            } else {
@@ -250,8 +250,8 @@ krb5_get_cred_from_kdc_opt(krb5_context context, krb5_ccache ccache,
                /* with current tgt.                              */
                /* Copy back in case invalided */
                tgt = otgt;
+               free_tgt = free_otgt;
                free_otgt = 0;
-               free_tgt = 1;
                if (!krb5_c_valid_enctype(tgt.keyblock.enctype)) {
                    retval = KRB5_PROG_ETYPE_NOSUPP;
                    goto cleanup;
@@ -304,16 +304,15 @@ krb5_get_cred_from_kdc_opt(krb5_context context, krb5_ccache ccache,
                                                          &tgtq.server)))
                            goto cleanup;
 
+                       if (free_otgt)
+                           krb5_free_cred_contents(context, &otgt);
                        otgt = tgt;
-                       free_otgt = 1;
+                       free_otgt = free_tgt;
                        free_tgt = 0;
                        retval = krb5_cc_retrieve_cred(context, ccache,
                                                            retr_flags,
                                                            &tgtq, &tgt);
                        if (retval == 0) {
-                           if (free_otgt)
-                             krb5_free_cred_contents(context, &otgt);
-                           free_otgt = 0;
                            free_tgt = 1;
                            /* Continues with 'got one as close as possible' */
                        } else {
@@ -324,8 +323,8 @@ krb5_get_cred_from_kdc_opt(krb5_context context, krb5_ccache ccache,
                            /* not in the cache so try and get one with our current tgt. */
   
                            tgt = otgt;
+                           free_tgt = free_otgt;
                            free_otgt = 0;
-                           free_tgt = 1;
                            if (!krb5_c_valid_enctype(tgt.keyblock.enctype)) {
                                retval = KRB5_PROG_ETYPE_NOSUPP;
                                goto cleanup;
@@ -359,9 +358,9 @@ krb5_get_cred_from_kdc_opt(krb5_context context, krb5_ccache ccache,
                            krb5_free_creds(context, tgtr);
                            tgtr = NULL;
 
-                           if (free_otgt) {
-                               krb5_free_cred_contents(context, &otgt);
-                               free_otgt = 0;
+                           if (free_tgt) {
+                               krb5_free_cred_contents(context, &tgt);
+                               free_tgt = 0;
                            }
              
                            tgt = *ret_tgts[ntgts++];