CCacheServer crashes iterating over creds which have been destroyed

ccs_list_release was trying to manually delete the iterators with a
broken for loop which skipped iterators.  Since the iterators were referenced
by the client, when the client exited it would tell the iterators to release
themselves.  The orphaned itertors would attempt to remove themselves from
their list (which had been released) resulting in a crash.

ticket: new

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20510 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/ccapi/server/ccs_list_internal.c b/src/ccapi/server/ccs_list_internal.c
index 07e5ee8d195cdc298bcba3c4b851b564563d76fc..1a8d0c639fdb5a2107c68bdaefc0371a3ea6e94a 100644 (file)
--- a/src/ccapi/server/ccs_list_internal.c
+++ b/src/ccapi/server/ccs_list_internal.c
@@ -123,13 +123,8 @@ cc_int32 ccs_list_release (ccs_list_t io_list)
 {
     cc_int32 err = ccNoError;
     
-    if (!err && io_list) {
-        cc_uint64 i;
-        
-        for (i = 0; i < cci_array_count (io_list->iterators); i++) {
-            ccs_list_iterator_release ((ccs_list_iterator_t) cci_array_object_at_index (io_list->iterators, i));
-        }
-        free (io_list->iterators);
+    if (!err && io_list) {        
+        cci_array_release (io_list->iterators);
         cci_array_release (io_list->objects);
         free (io_list);
     }
@@ -220,6 +215,7 @@ static cc_int32 ccs_list_find_index (ccs_list_t        in_list,
             if (!err && equal) {
                 found = 1;
                 *out_object_index = i;
+                break;
             }
         }        
     }
@@ -279,6 +275,7 @@ static cc_int32 ccs_list_find_iterator_index (ccs_list_t        in_list,
             if (!err && equal) {
                 found = 1;
                 *out_object_index = i;
+                break;
             }
         }        
     }