* network.c (delete_fd): Free pointed-to data after removing it from the

connection set.
(kill_tcp_connection): Move delete_fd call to the end.
(accept_tcp_connection): Decrement connection counter again if we drop the
incoming connection for lack of buffer space.

ticket: 2384
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@16201 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/ChangeLog b/src/kdc/ChangeLog
index a5a6e39f4552bb571e7bcec2abd03dfcd3e552ec..996aa442a372c3f99824543d2efd10b5df47de48 100644 (file)
--- a/src/kdc/ChangeLog
+++ b/src/kdc/ChangeLog
@@ -1,3 +1,11 @@
+2004-03-22  Ken Raeburn  <raeburn@mit.edu>
+
+       * network.c (delete_fd): Free pointed-to data after removing it
+       from the connection set.
+       (kill_tcp_connection): Move delete_fd call to the end.
+       (accept_tcp_connection): Decrement connection counter again if we
+       drop the incoming connection for lack of buffer space.
+
 2004-03-15  Sam Hartman  <hartmans@mit.edu>
 
        * kdc_preauth.c (verify_sam_response): Free unparsed names

diff --git a/src/kdc/network.c b/src/kdc/network.c
index cc79b8093574feccf5ff0c0c7ad4393202c1b2a7..ddbdf353369294f169e9e3bbc515064c4f26ffec 100644 (file)
--- a/src/kdc/network.c
+++ b/src/kdc/network.c
@@ -328,8 +328,9 @@ delete_fd (struct connection *xconn)
     FOREACH_ELT(connections, i, conn)
        if (conn == xconn) {
            DEL(connections, i);
-           return;
+           break;
        }
+    free(xconn);
 }
 
 static int
@@ -844,6 +845,7 @@ static void accept_tcp_connection(struct connection *conn, const char *prog,
                newconn->u.tcp.addrbuf);
        delete_fd(newconn);
        close(s);
+       tcp_data_counter--;
        return;
     }
     newconn->u.tcp.offset = 0;
@@ -860,7 +862,6 @@ static void accept_tcp_connection(struct connection *conn, const char *prog,
 static void
 kill_tcp_connection(struct connection *conn)
 {
-    delete_fd(conn);
     if (conn->u.tcp.response)
        krb5_free_data(kdc_context, conn->u.tcp.response);
     if (conn->u.tcp.buffer)
@@ -876,6 +877,7 @@ kill_tcp_connection(struct connection *conn)
            sstate.max--;
     close(conn->fd);
     conn->fd = -1;
+    delete_fd(conn);
     tcp_data_counter--;
 }