fixing memory scribbling in find_alternate_tgs

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@3790 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index a111b0fc75531c42d4628fbc23edf5a39301bb01..a96756e199c1973012bc81f8a548d3a8ad1f3984 100644 (file)
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -666,7 +666,7 @@ int *nprincs;
 {
     krb5_error_code retval;
     krb5_principal *plist, *pl2;
-    krb5_data *tmp;
+    krb5_data tmp;
 
     *nprincs = 0;
     *more = FALSE;
@@ -683,10 +683,10 @@ int *nprincs;
        ignore it */
     while (--pl2 > plist) {
        *nprincs = 1;
-       tmp = krb5_princ_realm(*pl2);
+       tmp = *krb5_princ_realm(*pl2);
        krb5_princ_set_realm(*pl2, krb5_princ_realm(tgs_server));
        retval = krb5_db_get_principal(*pl2, server, nprincs, more);
-       krb5_princ_set_realm(*pl2, tmp);
+       krb5_princ_set_realm(*pl2, &tmp);
        if (retval) {
            *nprincs = 0;
            *more = FALSE;
@@ -701,14 +701,14 @@ int *nprincs;
            krb5_principal tmpprinc;
            char *sname;
 
-           tmp = krb5_princ_realm(*pl2);
+           tmp = *krb5_princ_realm(*pl2);
            krb5_princ_set_realm(*pl2, krb5_princ_realm(tgs_server));
            if (retval = krb5_copy_principal(*pl2, &tmpprinc)) {
                krb5_db_free_principal(server, *nprincs);
-               krb5_princ_set_realm(*pl2, tmp);
+               krb5_princ_set_realm(*pl2, &tmp);
                continue;
            }
-           krb5_princ_set_realm(*pl2, tmp);
+           krb5_princ_set_realm(*pl2, &tmp);
 
            krb5_free_principal(request->server);
            request->server = tmpprinc;