pull up r19195 from trunk
authorTom Yu <tlyu@mit.edu>
Thu, 1 Mar 2007 20:29:57 +0000 (20:29 +0000)
committerTom Yu <tlyu@mit.edu>
Thu, 1 Mar 2007 20:29:57 +0000 (20:29 +0000)
commit196396e78d6acef5e845829f0a7615b96ca6f9df
tree87cb1de0532c7f7c23bc1473fcce2350ea505065
parent13b14ce15f2893bcb1ce6632136883f065e5eee7
pull up r19195 from trunk

 r19195@cathode-dark-space:  jaltman | 2007-02-28 20:49:11 -0500
 ticket: new
 subject: krb5_get_cred_from_kdc fails to null terminate the tgt list
 tags: pullup

  if the next tgt in a cross-realm traversal cannot be
  obtained find_nxt_kdc() was calling krb5_free_creds()
  on the last tgt in the list but was failing to nullify
  the pointer to the cred that was just freed.

  if there were no additional tgts obtained,
  krb5_get_cred_from_kdc() would return a non-NULL terminated
  cred list to the caller.  This would result in a crash
  when attempting to manipulate the non-existent cred past
  the end of the list.

  This commit nullifies the credential pointer in
  find_nxt_kdc() after the call to krb5_free_creds()

ticket: 5454
version_fixed: 1.6.1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@19197 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/krb/gc_frm_kdc.c