From: Ezra Peisach <epeisach@mit.edu>
Date: Sun, 3 Jan 2010 15:14:51 +0000 (+0000)
Subject: krb5_gss_acquire_cred will deref garbage pointer if actual_mechs is NULL
X-Git-Tag: krb5-1.8-alpha1~18
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=36bdbec726c7fd6799e08dce44fc010c5bd6ed70;p=krb5.git

krb5_gss_acquire_cred will deref garbage pointer if actual_mechs is NULL

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23572 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c
index 64efa1bfd..2ccf7dbf3 100644
--- a/src/lib/gssapi/krb5/acquire_cred.c
+++ b/src/lib/gssapi/krb5/acquire_cred.c
@@ -465,7 +465,7 @@ krb5_gss_acquire_cred(minor_status, desired_name, time_req,
     krb5_context context;
     size_t i;
     krb5_gss_cred_id_t cred;
-    gss_OID_set ret_mechs;
+    gss_OID_set ret_mechs = NULL;
     int req_old, req_new;
     OM_uint32 ret;
     krb5_error_code code;
@@ -693,8 +693,10 @@ krb5_gss_acquire_cred(minor_status, desired_name, time_req,
     /* intern the credential handle */
 
     if (! kg_save_cred_id((gss_cred_id_t) cred)) {
-        free(ret_mechs->elements);
-        free(ret_mechs);
+        if (ret_mechs) {
+            free(ret_mechs->elements);
+            free(ret_mechs);
+        }
         if (cred->ccache)
             (void)krb5_cc_close(context, cred->ccache);
 #ifndef LEAN_CLIENT