Always initialize the output token in gss_init_sec_context as required

by RFC 2744 section 5.19.  The krb5 code did this but the generic code
didn't, causing a double-free in OpenSSH.

Ticket: 3086
Version_Reported: 1.3.6

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@18114 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/gssapi/mechglue/g_init_sec_context.c b/src/lib/gssapi/mechglue/g_init_sec_context.c
index 4ff47f89943da66304af65348642fc0361d2ad9d..8f55ac5f4cef0dedecef9a236891346fb8749839 100644 (file)
--- a/src/lib/gssapi/mechglue/g_init_sec_context.c
+++ b/src/lib/gssapi/mechglue/g_init_sec_context.c
@@ -77,6 +77,8 @@ OM_uint32 *           time_rec;
     gss_cred_id_t      input_cred_handle;
 
     gss_initialize();
+    output_token->length = 0;
+    output_token->value = NULL;
 
     if (context_handle == NULL)
        return GSS_S_NO_CONTEXT;