3677. [bug] 'nsupdate' leaked memory if 'realm' was used multiple

                        times.  [RT #35073]

diff --git a/CHANGES b/CHANGES
index 68b4d31214967ea04d4f3e4a5004473ddb77141f..e87a941ec6b3ac9fc33c078c0cc96d56097312e8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3677.  [bug]           'nsupdate' leaked memory if 'realm' was used multiple
+                       times.  [RT #35073]
+
 3676.  [bug]           "named-checkconf -z" now checks zones of type
                        hint and redirect as well as master. [RT #35046]
 

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 486c1023250baba74f57cdfcdda8d2b0b14d1b7a..dc12a85eb20cfab7ed38f8106fec7684b3f20bde 100644 (file)
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -1566,16 +1566,20 @@ evaluate_realm(char *cmdline) {
 #ifdef GSSAPI
        char *word;
        char buf[1024];
+       int n;
 
-       word = nsu_strsep(&cmdline, " \t\r\n");
-       if (word == NULL || *word == 0) {
-               if (realm != NULL)
-                       isc_mem_free(mctx, realm);
+       if (realm != NULL) {
+               isc_mem_free(mctx, realm);
                realm = NULL;
-               return (STATUS_MORE);
        }
 
-       snprintf(buf, sizeof(buf), "@%s", word);
+       word = nsu_strsep(&cmdline, " \t\r\n");
+       if (word == NULL || *word == 0)
+               return (STATUS_MORE);
+
+       n = snprintf(buf, sizeof(buf), "@%s", word);
+       if (n < 0 || (size_t)n >= sizeof(buf))
+               fatal("realm is too long");
        realm = isc_mem_strdup(mctx, buf);
        if (realm == NULL)
                fatal("out of memory");