mk_req_ext.c (krb5_mk_req_extended): Sanitize how memory is freed in

	both error and normal cases, to remove memory leaks.

mk_req_ext.c (krb5_mk_req_extended): Use the encryption type specified
	by the ticket to generate the authenticator.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@4711 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog
index a9ed389f9a9ff8f822331d255686e1f3353f4102..fa0985ff9d9a02aa8023e0b7ff4be2a51905950c 100644 (file)
--- a/src/lib/krb5/krb/ChangeLog
+++ b/src/lib/krb5/krb/ChangeLog
@@ -1,5 +1,12 @@
 Mon Nov 21 15:30:07 1994  Theodore Y. Ts'o  (tytso@dcl)
 
+       * mk_req_ext.c (krb5_mk_req_extended): Sanitize how memory is
+               freed in both error and normal cases, to remove memory
+               leaks. 
+
+        * mk_req_ext.c (krb5_mk_req_extended): Use the encryption type
+               specified by the ticket to generate the authenticator.
+
        * encode_kdc.c (krb5_encode_kdc_rep): Now requires that the
                caller pass in the encryption block to be used for
                encrpyting the ticket.  That way, this routine doesn't

diff --git a/src/lib/krb5/krb/mk_req_ext.c b/src/lib/krb5/krb/mk_req_ext.c
index 13003a704a15b0da8e3f20a90e849dcd176f768d..d5639741fa04f7e57a93fd1a05bf4ffba2fec8b0 100644 (file)
--- a/src/lib/krb5/krb/mk_req_ext.c
+++ b/src/lib/krb5/krb/mk_req_ext.c
@@ -91,7 +91,14 @@ krb5_data *outbuf;
     krb5_enctype etype;
     krb5_encrypt_block eblock;
     krb5_data *toutbuf;
+    int cleanup_key = 0;
 
+    request.ticket = 0;
+    request.authenticator.ciphertext.data = 0;
+    if (newkey)
+       *newkey = 0;
+    scratch = 0;
+    
     if ((ap_req_options & AP_OPTS_USE_SESSION_KEY) &&
        !creds->ticket.length)
        return(KRB5_NO_TKT_SUPPLIED);
@@ -103,46 +110,34 @@ krb5_data *outbuf;
                                          creds))
            return(retval);
     }
-    /* verify a valid etype is available */
-    if (!valid_keytype(creds->keyblock.keytype))
-       return KRB5_PROG_KEYTYPE_NOSUPP;
-
-    if (creds->keyblock.etype == ETYPE_UNKNOWN)
-       etype = krb5_keytype_array[creds->keyblock.keytype]->system->proto_enctype;
-    else
-       etype = creds->keyblock.etype;
 
-    if (!valid_etype(etype))
-       return KRB5_PROG_ETYPE_NOSUPP;
-
-    request.ap_options = ap_req_options;
     /* we need a native ticket */
     if (retval = decode_krb5_ticket(&creds->ticket, &request.ticket))
        return(retval);
+    
+    /* verify a valid etype is available */
+    etype = request.ticket->enc_part.etype;
 
-#define cleanup_ticket() krb5_free_ticket(request.ticket)
+    if (!valid_etype(etype)) {
+       retval = KRB5_PROG_ETYPE_NOSUPP;
+       goto cleanup;
+    }
+
+    request.ap_options = ap_req_options;
     if (newkey) {
-       if (retval = krb5_generate_subkey(&creds->keyblock, newkey)) {
-           cleanup_ticket();
-           return retval;
-       }
+       if (retval = krb5_generate_subkey(&creds->keyblock, newkey))
+           goto cleanup;
     }
-#define cleanup_key() {if (newkey) krb5_free_keyblock(*newkey);}
+
     if (retval = krb5_generate_authenticator(&authent, creds->client, checksum,
                                             newkey ? *newkey : 0,
-                                            sequence, creds->authdata)) {
-       cleanup_key();
-       cleanup_ticket();
-       return retval;
-    }
-    
+                                            sequence, creds->authdata))
+       goto cleanup;
+       
     /* encode the authenticator */
     retval = encode_krb5_authenticator(&authent, &scratch);
-    if (retval) {
-       cleanup_key();
-       cleanup_ticket();
-       return(retval);
-    }
+    if (retval)
+       goto cleanup;
     
     /* Null out these fields, to prevent pointer sharing problems;
      * they were supplied by the caller
@@ -155,78 +150,68 @@ krb5_data *outbuf;
     else
            krb5_free_authenticator_contents(&authent);
 
-#define cleanup_scratch() { (void) memset(scratch->data, 0, scratch->length); \
-krb5_free_data(scratch); }
-
     /* put together an eblock for this encryption */
 
     krb5_use_cstype(&eblock, etype);
     request.authenticator.etype = etype;
-    request.authenticator.kvno = 0; /* XXX user set? */
+    request.authenticator.kvno = 0;
     request.authenticator.ciphertext.length =
        krb5_encrypt_size(scratch->length, eblock.crypto_entry);
     /* add padding area, and zero it */
     if (!(scratch->data = realloc(scratch->data,
                                  request.authenticator.ciphertext.length))) {
        /* may destroy scratch->data */
-       krb5_xfree(scratch);
        retval = ENOMEM;
-       goto clean_ticket;
+       goto cleanup;
     }
     memset(scratch->data + scratch->length, 0,
          request.authenticator.ciphertext.length - scratch->length);
     if (!(request.authenticator.ciphertext.data =
          malloc(request.authenticator.ciphertext.length))) {
        retval = ENOMEM;
-       goto clean_scratch;
+       goto cleanup;
     }
 
-#define cleanup_encpart() {\
-(void) memset(request.authenticator.ciphertext.data, 0,\
-            request.authenticator.ciphertext.length); \
-free(request.authenticator.ciphertext.data); \
-request.authenticator.ciphertext.length = 0; \
-request.authenticator.ciphertext.data = 0;}
-
     /* do any necessary key pre-processing */
-    if (retval = krb5_process_key(&eblock, &creds->keyblock)) {
-       goto clean_encpart;
-    }
+    if (retval = krb5_process_key(&eblock, &creds->keyblock))
+       goto cleanup;
 
-#define cleanup_prockey() {(void) krb5_finish_key(&eblock);}
+    cleanup_key++;
 
     /* call the encryption routine */
     if (retval = krb5_encrypt((krb5_pointer) scratch->data,
                              (krb5_pointer) request.authenticator.ciphertext.data,
-                             scratch->length, &eblock, 0)) {
-       goto clean_prockey;
-    }
+                             scratch->length, &eblock, 0))
+       goto cleanup;
 
-    /* authenticator now assembled-- do some cleanup */
-    cleanup_scratch();
-
-    if (retval = krb5_finish_key(&eblock)) {
-       cleanup_encpart();
-       return retval;
+    if (retval = krb5_finish_key(&eblock))
+       goto cleanup;
+    cleanup_key = 0;
+    
+    retval = encode_krb5_ap_req(&request, &toutbuf);
+    if (retval)
+       goto cleanup;
+    
+    *outbuf = *toutbuf;
+    krb5_xfree(toutbuf);
+
+cleanup:
+    if (request.ticket)
+       krb5_free_ticket(request.ticket);
+    if (request.authenticator.ciphertext.data) {
+       (void) memset(request.authenticator.ciphertext.data, 0,
+                     request.authenticator.ciphertext.length);
+       free(request.authenticator.ciphertext.data);
     }
-
-    if (!(retval = encode_krb5_ap_req(&request, &toutbuf))) {
-       *outbuf = *toutbuf;
-       krb5_xfree(toutbuf);
+    if (newkey && *newkey)
+       krb5_free_keyblock(*newkey);
+    if (scratch) {
+       memset(scratch->data, 0, scratch->length);
+        krb5_xfree(scratch->data);
+       krb5_xfree(scratch);
     }
-    cleanup_ticket();
-    cleanup_encpart();
-    return retval;
-
- clean_prockey:
-    cleanup_prockey();
- clean_encpart:
-    cleanup_encpart();
- clean_scratch:
-    cleanup_scratch();
- clean_ticket:
-    cleanup_key();
-    cleanup_ticket();
+    if (cleanup_key)
+       krb5_finish_key(&eblock);
 
     return retval;
 }