From: Tom Yu <tlyu@mit.edu>
Date: Wed, 25 Apr 2007 21:19:07 +0000 (+0000)
Subject: race condition in referrals fallback
X-Git-Tag: krb5-1.7-alpha1~1123
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=220799ba475ec8044fedf544c15fab34d090b3a1;p=krb5.git

race condition in referrals fallback

	* src/lib/krb5/krb/gc_frm_kdc.c (krb5_get_cred_from_kdc_opt):
	During referrals fallback, set *tgts to NULL after freeing.  This
	avoids returning a pointer to freed memory when the first call to
	do_traversal() obtains some TGTs and the subsequent
	krb5_cc_retrieve_cred() of the final-hop TGT succeeds (due to some
	other thread or process storing that TGT into the ccache), causing
	second do_traversal() call (which would re-initialize *tgts) to
	not execute.  Race condition found during KfW-3.2 testing.

ticket: new
target_version: 1.6.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19526 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/krb5/krb/gc_frm_kdc.c b/src/lib/krb5/krb/gc_frm_kdc.c
index 4890bad50..5b9d3917a 100644
--- a/src/lib/krb5/krb/gc_frm_kdc.c
+++ b/src/lib/krb5/krb/gc_frm_kdc.c
@@ -1043,6 +1043,7 @@ krb5_get_cred_from_kdc_opt(krb5_context context, krb5_ccache ccache,
 	    krb5_free_creds(context, (*tgts)[i]);
 	}
 	free(*tgts);
+	*tgts = NULL;
     }
     context->use_conf_ktypes = 1;
     retval = krb5_cc_retrieve_cred(context, ccache, RETR_FLAGS,