From: Nalin Dahyabhai <nalin@redhat.com>
Date: Wed, 25 Jun 2014 16:56:42 +0000 (-0400)
Subject: Fix unlikely null dereference in mk_cred()
X-Git-Tag: krb5-1.12.2-final~20
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e5bb07c9eb7ddb3cc575dfa238748f7227f1fdd2;p=thirdparty%2Fkrb5.git

Fix unlikely null dereference in mk_cred()

If krb5_encrypt_keyhelper() returns an error, the ciphertext structure
may contain a non-zero length, but it will already have freed the
pointer to its data, making encrypt_credencpart()'s subsequent attempt
to clear and free the memory fail.  Remove that logic.

Based on a patch from Jatin Nansi.

(cherry picked from commit 476284de8dc9a52b5544445cb1b316a417ae88f0)

ticket: 7948
version_fixed: 1.12.2
status: resolved
---

diff --git a/src/lib/krb5/krb/mk_cred.c b/src/lib/krb5/krb/mk_cred.c
index a31d85cac6..7616c3a7a9 100644
--- a/src/lib/krb5/krb/mk_cred.c
+++ b/src/lib/krb5/krb/mk_cred.c
@@ -49,13 +49,6 @@ encrypt_credencpart(krb5_context context, krb5_cred_enc_part *pcredpart,
                                   KRB5_KEYUSAGE_KRB_CRED_ENCPART, scratch,
                                   pencdata);
 
-    if (retval) {
-        memset(pencdata->ciphertext.data, 0, pencdata->ciphertext.length);
-        free(pencdata->ciphertext.data);
-        pencdata->ciphertext.length = 0;
-        pencdata->ciphertext.data = 0;
-    }
-
     memset(scratch->data, 0, scratch->length);
     krb5_free_data(context, scratch);