* accept_sec_context.c (krb5_gss_accept_sec_context): Only free

	ap_req.data if it was allocated by kg2_parse_token(), otherwise we
	lose very badly trying to free the middle of a potentially
	malloc()'ed block, possibly coredumping.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10925 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/gssapi/krb5/ChangeLog b/src/lib/gssapi/krb5/ChangeLog
index a852fe00150bb6392177a7564ce1893b02190f89..156ef4e3a70d6834ea2dae1593bccccff029b3bc 100644 (file)
--- a/src/lib/gssapi/krb5/ChangeLog
+++ b/src/lib/gssapi/krb5/ChangeLog
@@ -1,3 +1,10 @@
+Mon Sep 21 00:32:28 1998  Tom Yu  <tlyu@mit.edu>
+
+       * accept_sec_context.c (krb5_gss_accept_sec_context): Only free
+       ap_req.data if it was allocated by kg2_parse_token(), otherwise we
+       lose very badly trying to free the middle of a potentially
+       malloc()'ed block, possibly coredumping.
+
 Thu Sep  3 19:35:44 1998  Tom Yu  <tlyu@mit.edu>
 
        * accept_sec_context.c (krb5_gss_accept_sec_context): Fix typo;

diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index d4e83cc64c56b7276f590dbfce5738e411a12636..011016f41b46d0cb5b0ab116dac88b3c90ce3c25 100644 (file)
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -926,7 +926,7 @@ krb5_gss_accept_sec_context(minor_status, context_handle,
           krb5_free_principal(context, deleg_cred->princ);
        xfree(deleg_cred);
    }
-   if (ap_req.data)
+   if (ap_req.data && gsskrb5_vers == 2000)
        xfree(ap_req.data);
    if (ap_rep.data)
        xfree(ap_rep.data);