Followon fixes to r23712:

* A few formatting fixes.
* Fix unlikely leak in kdc_handle_protected_negotiation: if
  add_pa_data_element with copy == FALSE fails, it's still the
  caller's responsibility to free pa.contents.
* Fix pre-existing (since r23465) leak of reply_encpart.enc_padata in
  process_as_req.
* Call add_pa_data_element with copy == TRUE in
  return_referral_enc_padata since we are passing memory owned by the
  database entry.

ticket: 6656

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23714 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index a5b710043039aaab23e498ac04bf3f26fb11fd8f..b183dcfc7b2671b7a93089d1b415e237042cd95a 100644 (file)
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -133,6 +133,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
     server_keyblock.contents = NULL;
     client_keyblock.contents = NULL;
     reply.padata = 0;
+    reply_encpart.enc_padata = 0;
     memset(&reply, 0, sizeof(reply));
 
     session_key.contents = 0;
@@ -623,7 +624,8 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
         goto errout;
     }
     errcode = return_enc_padata(kdc_context, req_pkt, request,
-                                as_encrypting_key, &server, &reply_encpart, FALSE);
+                                as_encrypting_key, &server, &reply_encpart,
+                                FALSE);
     if (errcode) {
         status = "KDC_RETURN_ENC_PADATA";
         goto errout;
@@ -689,6 +691,8 @@ egress:
         krb5_free_keyblock_contents(kdc_context, &client_keyblock);
     if (reply.padata != NULL)
         krb5_free_pa_data(kdc_context, reply.padata);
+    if (reply_encpart.enc_padata)
+        krb5_free_pa_data(kdc_context, reply_encpart.enc_padata);
 
     if (cname != NULL)
         free(cname);

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 52256e7bd865d429d27c9c5bb787e809a4b50f04..cb0496f9da3059f71639a52402b537c26871ac4e 100644 (file)
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -950,13 +950,14 @@ tgt_again:
     }
     errcode = return_enc_padata(kdc_context, pkt, request,
                                 reply_key, &server, &reply_encpart,
-                                is_referral && isflagset(s_flags, KRB5_KDB_FLAG_CANONICALIZE));
+                                is_referral &&
+                                isflagset(s_flags,
+                                          KRB5_KDB_FLAG_CANONICALIZE));
     if (errcode) {
         status = "KDC_RETURN_ENC_PADATA";
         goto cleanup;
     }
 
-
     errcode = krb5_encode_kdc_rep(kdc_context, KRB5_TGS_REP, &reply_encpart,
                                   subkey ? 1 : 0,
                                   reply_key,

diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index 05df3940c5795812c33960c3fe1d7095af34f83d..00800aab0520af73a5002026fbcb23d07b7b0194 100644 (file)
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -3086,9 +3086,10 @@ include_pac_p(krb5_context context, krb5_kdc_req *request)
 
 static krb5_error_code
 return_referral_enc_padata( krb5_context context,
-                            krb5_enc_kdc_rep_part *reply, krb5_db_entry *server)
+                            krb5_enc_kdc_rep_part *reply,
+                            krb5_db_entry *server)
 {
-        krb5_error_code             code;
+    krb5_error_code             code;
     krb5_tl_data                tl_data;
     krb5_pa_data                pa_data;
 
@@ -3101,10 +3102,9 @@ return_referral_enc_padata( krb5_context context,
     pa_data.pa_type = KRB5_PADATA_SVR_REFERRAL_INFO;
     pa_data.length = tl_data.tl_data_length;
     pa_data.contents = tl_data.tl_data_contents;
-    return add_pa_data_element(context, &pa_data, &reply->enc_padata, FALSE);
+    return add_pa_data_element(context, &pa_data, &reply->enc_padata, TRUE);
 }
 
-
 krb5_error_code
 return_enc_padata(krb5_context context, krb5_data *req_pkt,
                   krb5_kdc_req *request, krb5_keyblock *reply_key,

diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
index 95f495a82082ed4c134648f03aa3c68c34cccdb1..d63bba2532250137ace56a2a157ba8d561059b3e 100644 (file)
--- a/src/kdc/kdc_util.c
+++ b/src/kdc/kdc_util.c
@@ -2697,9 +2697,9 @@ kdc_handle_protected_negotiation(krb5_data *req_pkt, krb5_kdc_req *request,
     pa.contents = (krb5_octet *) out->data;
     pa.length = out->length;
     retval = add_pa_data_element(kdc_context, &pa, out_enc_padata, FALSE);
-    out->data = NULL;
     if (retval)
         goto cleanup;
+    out->data = NULL;
     pa.magic = KV5M_PA_DATA;
     pa.pa_type = KRB5_PADATA_FX_FAST;
     pa.length = 0;

diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
index 4b81376f3dbdac1aa4a5ff99cc6239c9ad6d26e3..03ecaf7c1cca02e3cc569ec52f34fde4c62fdb40 100644 (file)
--- a/src/kdc/kdc_util.h
+++ b/src/kdc/kdc_util.h
@@ -259,7 +259,7 @@ return_enc_padata(krb5_context context,
                   krb5_keyblock *reply_key,
                   krb5_db_entry *server,
                   krb5_enc_kdc_rep_part *reply_encpart,
-krb5_boolean is_referral);
+                  krb5_boolean is_referral);
 
 krb5_error_code
 sign_db_authdata (krb5_context context,