Error handling bug in krb5_init_creds_init()

Fix a bug in krb5_init_creds_init() where a freed context could be
returned to the caller in certain error cases.

ticket: 6722
tags: pullup
target_version: 1.8.2

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24020 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index e97984f5084187beef84ec1beec8fc88271ef63c..63402ca0329e18c433de0b5d3915fbfc0a27f28c 100644 (file)
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -965,14 +965,15 @@ krb5_init_creds_init(krb5_context context,
         krb5_princ_type(context, ctx->request->client) = KRB5_NT_WELLKNOWN;
     }
     code = restart_init_creds_loop(context, ctx, NULL);
+    if (code)
+        goto cleanup;
 
     *pctx = ctx;
+    ctx = NULL;
 
 cleanup:
-    if (code != 0)
-        krb5_init_creds_free(context, ctx);
-    if (str != NULL)
-        free(str);
+    krb5_init_creds_free(context, ctx);
+    free(str);
 
     return code;
 }