From: Xuqing Yang <rigelyoung@icloud.com>
Date: Sun, 9 Aug 2026 02:42:59 +0000 (+0800)
Subject: auth/kerberos: fix PAC data leak on unparse failure
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d5846a1aba986fe131a419ef4237f451f3a1b53d;p=thirdparty%2Fsamba.git

auth/kerberos: fix PAC data leak on unparse failure

kerberos_create_pac() returns directly when
krb5_unparse_name_flags() fails, leaking the caller-owned
pac_data hierarchy. Free pac_data before returning the error.

Signed-off-by: Xuqing Yang <rigelyoung@icloud.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Anoop C S <anoopcs@samba.org>

Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Aug 11 09:06:09 UTC 2026 on atb-devel-224
---

diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index 4ba2bf0fe9f..6c7bf7aed8a 100644
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -258,6 +258,7 @@
 				      KRB5_PRINCIPAL_UNPARSE_DISPLAY,
 				      &name);
 	if (ret) {
+		talloc_free(pac_data);
 		return ret;
 	}
 	LOGON_NAME->account_name	= talloc_strdup(LOGON_NAME, name);