From: Michał Kępień <michal@isc.org>
Date: Thu, 8 Apr 2021 08:33:44 +0000 (+0200)
Subject: Free resources when gss_accept_sec_context() fails
X-Git-Tag: v9.17.12~8^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d954e152d9f2901118b1fe36d3931ec244317fab;p=thirdparty%2Fbind9.git

Free resources when gss_accept_sec_context() fails

Even if a call to gss_accept_sec_context() fails, it might still cause a
GSS-API response token to be allocated and left for the caller to
release.  Make sure the token is released before an early return from
dst_gssapi_acceptctx().
---

diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index ee512041fe6..6132d863e6b 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -739,6 +739,9 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	default:
 		gss_log(3, "failed gss_accept_sec_context: %s",
 			gss_error_tostring(gret, minor, buf, sizeof(buf)));
+		if (gouttoken.length > 0U) {
+			(void)gss_release_buffer(&minor, &gouttoken);
+		}
 		return (result);
 	}