use-after-free bugs

Fix some bugs with storage being used immediately after being freed.
None look like anything an attacker can really manipulate AFAICT.

ticket: new
target_version: 1.6.4
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20485 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
index cf93e86676855019efd35434973429ee8a8d2cc4..a6435acf9c5e1f2a0b5c66ae01fe446d40762f1c 100644 (file)
--- a/src/kadmin/server/server_stubs.c
+++ b/src/kadmin/server/server_stubs.c
@@ -1631,7 +1631,7 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
      }
 
      if (ret.code != 0)
-        errmsg = krb5_get_error_message(handle ? handle->context : NULL, ret.code);
+        errmsg = krb5_get_error_message(NULL, ret.code);
      else
         errmsg = "success";
 

diff --git a/src/kdc/network.c b/src/kdc/network.c
index 82b1c7768850b09752d9194286603ad800ea9da2..1072fce3d021bf78a9c9a5b95434009e1ed71225 100644 (file)
--- a/src/kdc/network.c
+++ b/src/kdc/network.c
@@ -1086,10 +1086,8 @@ static void process_packet(struct connection *conn, const char *prog,
        return;
     }
     if (cc != response->length) {
-       krb5_free_data(kdc_context, response);
        com_err(prog, 0, "short reply write %d vs %d\n",
                response->length, cc);
-       return;
     }
     krb5_free_data(kdc_context, response);
     return;

diff --git a/src/lib/krb5/krb/mk_cred.c b/src/lib/krb5/krb/mk_cred.c
index cb446471781cb23f29ce219a42dd38b5f22dc939..3479aa29eff8d7ce3c75c14c107b158a54fc7798 100644 (file)
--- a/src/lib/krb5/krb/mk_cred.c
+++ b/src/lib/krb5/krb/mk_cred.c
@@ -183,8 +183,8 @@ krb5_mk_ncred(krb5_context context, krb5_auth_context auth_context,
 
     if ((pcred->tickets 
       = (krb5_ticket **)malloc(sizeof(krb5_ticket *) * (ncred + 1))) == NULL) {
-       retval = ENOMEM;
        free(pcred);
+       return ENOMEM;
     }
     memset(pcred->tickets, 0, sizeof(krb5_ticket *) * (ncred +1));
 

diff --git a/src/slave/kprop.c b/src/slave/kprop.c
index b2ea2c2b36790aeeb5352e9ad762ea9ce3b744e1..42bc8fbdab33814eacac45705d239bbacd713a24 100644 (file)
--- a/src/slave/kprop.c
+++ b/src/slave/kprop.c
@@ -1,7 +1,7 @@
 /*
  * slave/kprop.c
  *
- * Copyright 1990,1991 by the Massachusetts Institute of Technology.
+ * Copyright 1990,1991,2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -505,12 +505,12 @@ open_database(context, data_fn, size)
                free(data_ok_fn);
                exit(1);
        }
-       free(data_ok_fn);
        if (stbuf.st_mtime > stbuf_ok.st_mtime) {
                com_err(progname, 0, "'%s' more recent than '%s'.",
                        data_fn, data_ok_fn);
                exit(1);
        }
+       free(data_ok_fn);
        *size = stbuf.st_size;
        return(fd);
 }