In pkinit_crypto_openssl.c, modified pkinit_octetstring2key() to

eliminate a possible memory leak in the error path, where the
key_block->length was set to zero but the key_block->contents were
not freed.  Also, changed calloc() call to a malloc() call to avoid
allocating up to 8 times as much buffer space as needed.

In keyblocks.c, modified kr5_free_keyblock_contents() to set the
key->length to zero after the key->contents have been freed.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25189 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/crypto/krb/keyblocks.c b/src/lib/crypto/krb/keyblocks.c
index 21faa563115e31aad516cb48573d2fde8e8e8776..98696f5086e133d9fa2189ef24f939f9a595a03f 100644 (file)
--- a/src/lib/crypto/krb/keyblocks.c
+++ b/src/lib/crypto/krb/keyblocks.c
@@ -68,6 +68,7 @@ krb5int_c_free_keyblock_contents(krb5_context context, krb5_keyblock *key)
     if (key && key->contents) {
         zapfree(key->contents, key->length);
         key->contents = NULL;
+        key->length = 0;
     }
 }
 

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 4247524ae54e18581922b0dc0ba24ea40033009f..6f7023f700bdfddd5ee6e12b93c8f70dc2e523c6 100644 (file)
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2143,7 +2143,7 @@ pkinit_octetstring2key(krb5_context context,
         goto cleanup;
 
     key_block->length = keylength;
-    key_block->contents = calloc(keylength, sizeof(unsigned char *));
+    key_block->contents = malloc(keylength);
     if (key_block->contents == NULL) {
         retval = ENOMEM;
         goto cleanup;
@@ -2156,9 +2156,9 @@ pkinit_octetstring2key(krb5_context context,
 
 cleanup:
     free(buf);
-    if (retval && key_block->contents != NULL && key_block->length != 0) {
-        memset(key_block->contents, 0, key_block->length);
-        key_block->length = 0;
+    // If this is an error return, free the allocated keyblock, if any
+    if (retval) {
+        krb5_free_keyblock_contents(context, key_block);
     }
 
     return retval;