Release gnamebuf also on the error path

In dst_gssapi_acceptctx(), the gnamebuf could leak a little bit of
memory if dns_name_fromtext() would theoretically fail.  This would
require a Kerberos principal with invalid DNS name.

(cherry picked from commit 3ad87f1ad612fb6adce175760483735066300266)

diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 74505e3cd0ce14b63df77e534866ed2934e03a5b..60fac791a07df3ae070ae98099ec4447393a8626 100644 (file)
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -774,15 +774,6 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 
                CHECK(dns_name_fromtext(principal, &namebuf, dns_rootname, 0,
                                        NULL));
-
-               if (gnamebuf.length != 0U) {
-                       gret = gss_release_buffer(&minor, &gnamebuf);
-                       if (gret != GSS_S_COMPLETE) {
-                               gss_log(3, "failed gss_release_buffer: %s",
-                                       gss_error_tostring(gret, minor, buf,
-                                                          sizeof(buf)));
-                       }
-               }
        } else {
                result = DNS_R_CONTINUE;
        }
@@ -790,6 +781,15 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
        *ctxout = context;
 
 cleanup:
+       if (gnamebuf.length != 0U) {
+               gret = gss_release_buffer(&minor, &gnamebuf);
+               if (gret != GSS_S_COMPLETE) {
+                       gss_log(3, "failed gss_release_buffer: %s",
+                               gss_error_tostring(gret, minor, buf,
+                                                  sizeof(buf)));
+               }
+       }
+
        if (gname != NULL) {
                gret = gss_release_name(&minor, &gname);
                if (gret != GSS_S_COMPLETE) {