make it the caller's responsibility to clean up creds

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@1275 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/mk_req_ext.c b/src/lib/krb5/krb/mk_req_ext.c
index 53f5b0c8b8620d0a2d0cd0624bf9f70abb831a8a..63c191ee8ac7f126788a869a651196b4d55f8f3e 100644 (file)
--- a/src/lib/krb5/krb/mk_req_ext.c
+++ b/src/lib/krb5/krb/mk_req_ext.c
@@ -50,6 +50,10 @@ static char rcsid_mk_req_ext_c[] =
  The outbuf buffer storage is allocated, and should be freed by the
  caller when finished.
 
+ On an error return, the credentials pointed to by creds might have been
+ augmented with additional fields from the obtained credentials; the entire
+ credentials should be released by calling krb5_free_creds().
+
  returns system errors
 */
 static krb5_error_code generate_authenticator PROTOTYPE((krb5_authenticator *,
@@ -100,7 +104,7 @@ krb5_data *outbuf;
     request.ap_options = ap_req_options;
     /* we need a native ticket */
     if (retval = decode_krb5_ticket(&creds->ticket, &request.ticket))
-       return(retval);                 /* XXX who cleans up creds? */
+       return(retval);
 
 #define cleanup_ticket() krb5_free_ticket(request.ticket)
     if (retval = generate_authenticator(&authent, creds, checksum)) {