auth/kerberos: avoid double-free on PAC encoding failure

kerberos_create_pac() allocates pac_data and remains responsible for
freeing it after kerberos_encode_pac() returns.

However, kerberos_encode_pac() also frees pac_data on several checksum
and NDR encoding error paths. If PAC encoding fails, the caller then
passes the dangling pointer to talloc_free() a second time.

Treat pac_data as caller-owned in kerberos_encode_pac() and remove the
callee's error-path frees. This ensures that pac_data is released exactly
once by kerberos_create_pac().

Signed-off-by: Xuqing Yang <rigelyoung@icloud.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index 962a87448059512e6d17230192917a7d27d49053..4ba2bf0fe9f45b5d762f9cde92b587da43bd87b1 100644 (file)
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -65,7 +65,6 @@
                if (ret) {
                        DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
                                  smb_get_krb5_error_message(context, ret, mem_ctx)));
-                       talloc_free(pac_data);
                        return ret;
                }
        }
@@ -84,7 +83,6 @@
                if (ret) {
                        DEBUG(2, ("making service PAC checksum failed: %s\n",
                                  smb_get_krb5_error_message(context, ret, mem_ctx)));
-                       talloc_free(pac_data);
                        return ret;
                }
        }
@@ -108,7 +106,6 @@
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                nt_status = ndr_map_error2ntstatus(ndr_err);
                DEBUG(1, ("PAC (presig) push failed: %s\n", nt_errstr(nt_status)));
-               talloc_free(pac_data);
                return EINVAL;
        }
 
@@ -123,7 +120,6 @@
        if (ret) {
                DBG_WARNING("making krbtgt PAC srv_checksum failed: %s\n",
                            smb_get_krb5_error_message(context, ret, mem_ctx));
-               talloc_free(pac_data);
                return ret;
        }
 
@@ -137,7 +133,6 @@
        if (ret) {
                DBG_WARNING("making krbtgt PAC kdc_checksum failed: %s\n",
                            smb_get_krb5_error_message(context, ret, mem_ctx));
-               talloc_free(pac_data);
                return ret;
        }
 
@@ -148,7 +143,6 @@
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                nt_status = ndr_map_error2ntstatus(ndr_err);
                DEBUG(1, ("PAC (final) push failed: %s\n", nt_errstr(nt_status)));
-               talloc_free(pac_data);
                return EINVAL;
        }