From: Greg Hudson <ghudson@mit.edu>
Date: Thu, 17 Mar 2011 22:10:44 +0000 (+0000)
Subject: KDC memory leak of reply padata for FAST replies
X-Git-Tag: krb5-1.10-alpha1~528
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=05bccaa5a0d4eba3845fb26a0914ffe891f154ca;p=krb5.git

KDC memory leak of reply padata for FAST replies

kdc_fast_response_handle_padata() replaces rep->padata, causing the
old value to be leaked.  As a minimal fix, free the old value of
rep->padata before replacing it.

ticket: 6885
target_version: 1.9.1
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24724 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c
index bc5a77bfa..65e4600b3 100644
--- a/src/kdc/fast_util.c
+++ b/src/kdc/fast_util.c
@@ -338,6 +338,7 @@ kdc_fast_response_handle_padata(struct kdc_request_state *state,
         pa[0].length = encrypted_reply->length;
         pa[0].contents = (unsigned char *)  encrypted_reply->data;
         pa_array[0] = &pa[0];
+        krb5_free_pa_data(kdc_context, rep->padata);
         rep->padata = pa_array;
         pa_array = NULL;
         free(encrypted_reply);