pull up r20608 from trunk

 ------------------------------------------------------------------------
 r20608 | raeburn | 2008-08-05 20:05:47 -0400 (Tue, 05 Aug 2008) | 9 lines

 ticket: new
 subject: fix cleanup code in allocating preauth info
 target_version: 1.6.4
 tags: pullup

 After an allocation failure, free up the previously allocated array
 elements by counting back down to zero, not continuing to count up
 until we hit zero.

ticket: 6064
version_fixed: 1.6.4
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@22429 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index d54d893e60d57ce9cf90dc57d2cb86e4b4f107e9..5f15d5be938432f9a68092421c59b4b6507fe0e7 100644 (file)
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -1,7 +1,7 @@
 /*
  * lib/krb5/krb/get_in_tkt.c
  *
- * Copyright 1990,1991, 2003 by the Massachusetts Institute of Technology.
+ * Copyright 1990,1991, 2003, 2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -409,7 +409,7 @@ make_preauth_list(krb5_context      context,
     for (i=0; i<nptypes; i++) {
        if ((preauthp[i] =
             (krb5_pa_data *) malloc(sizeof(krb5_pa_data))) == NULL) {
-           for (; i>=0; i++)
+           for (; i>=0; i--)
                free(preauthp[i]);
            free(preauthp);
            return (ENOMEM);