From: Xuqing Yang <rigelyoung@icloud.com>
Date: Fri, 31 Jul 2026 17:30:28 +0000 (+0800)
Subject: auth/kerberos: avoid double-free on PAC encoding failure
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e0ad5e2ee9045a45366e0073a935941cf9e14f18;p=thirdparty%2Fsamba.git

auth/kerberos: avoid double-free on PAC encoding failure

kerberos_create_pac() allocates pac_data and remains responsible for
freeing it after kerberos_encode_pac() returns.

However, kerberos_encode_pac() also frees pac_data on several checksum
and NDR encoding error paths. If PAC encoding fails, the caller then
passes the dangling pointer to talloc_free() a second time.

Treat pac_data as caller-owned in kerberos_encode_pac() and remove the
callee's error-path frees. This ensures that pac_data is released exactly
once by kerberos_create_pac().

Signed-off-by: Xuqing Yang <rigelyoung@icloud.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
---

diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index 962a8744805..4ba2bf0fe9f 100644
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -65,7 +65,6 @@
 		if (ret) {
 			DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
 				  smb_get_krb5_error_message(context, ret, mem_ctx)));
-			talloc_free(pac_data);
 			return ret;
 		}
 	}
@@ -84,7 +83,6 @@
 		if (ret) {
 			DEBUG(2, ("making service PAC checksum failed: %s\n",
 				  smb_get_krb5_error_message(context, ret, mem_ctx)));
-			talloc_free(pac_data);
 			return ret;
 		}
 	}
@@ -108,7 +106,6 @@
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(1, ("PAC (presig) push failed: %s\n", nt_errstr(nt_status)));
-		talloc_free(pac_data);
 		return EINVAL;
 	}
 
@@ -123,7 +120,6 @@
 	if (ret) {
 		DBG_WARNING("making krbtgt PAC srv_checksum failed: %s\n",
 			    smb_get_krb5_error_message(context, ret, mem_ctx));
-		talloc_free(pac_data);
 		return ret;
 	}
 
@@ -137,7 +133,6 @@
 	if (ret) {
 		DBG_WARNING("making krbtgt PAC kdc_checksum failed: %s\n",
 			    smb_get_krb5_error_message(context, ret, mem_ctx));
-		talloc_free(pac_data);
 		return ret;
 	}
 
@@ -148,7 +143,6 @@
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(1, ("PAC (final) push failed: %s\n", nt_errstr(nt_status)));
-		talloc_free(pac_data);
 		return EINVAL;
 	}