auth/kerberos: fix PAC data leak on unparse failure

kerberos_create_pac() returns directly when
krb5_unparse_name_flags() fails, leaking the caller-owned
pac_data hierarchy. Free pac_data before returning the error.

Signed-off-by: Xuqing Yang <rigelyoung@icloud.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Aug 11 09:06:09 UTC 2026 on atb-devel-224

diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index 4ba2bf0fe9f45b5d762f9cde92b587da43bd87b1..6c7bf7aed8a71290212d0774e1019630f19faa27 100644 (file)
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -258,6 +258,7 @@
                                      KRB5_PRINCIPAL_UNPARSE_DISPLAY,
                                      &name);
        if (ret) {
+               talloc_free(pac_data);
                return ret;
        }
        LOGON_NAME->account_name        = talloc_strdup(LOGON_NAME, name);