From: Sam Hartman <hartmans@mit.edu>
Date: Mon, 19 Sep 2011 00:34:48 +0000 (+0000)
Subject: In pkinit_crypto_openssl.c, modified pkinit_octetstring2key() to
X-Git-Tag: krb5-1.10-alpha1~186
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=61c280a73539acbe68bb203ea8f09cf52cf4b784;p=krb5.git

In pkinit_crypto_openssl.c, modified pkinit_octetstring2key() to
eliminate a possible memory leak in the error path, where the
key_block->length was set to zero but the key_block->contents were
not freed.  Also, changed calloc() call to a malloc() call to avoid
allocating up to 8 times as much buffer space as needed.

In keyblocks.c, modified kr5_free_keyblock_contents() to set the
key->length to zero after the key->contents have been freed.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25189 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/crypto/krb/keyblocks.c b/src/lib/crypto/krb/keyblocks.c
index 21faa5631..98696f508 100644
--- a/src/lib/crypto/krb/keyblocks.c
+++ b/src/lib/crypto/krb/keyblocks.c
@@ -68,6 +68,7 @@ krb5int_c_free_keyblock_contents(krb5_context context, krb5_keyblock *key)
     if (key && key->contents) {
         zapfree(key->contents, key->length);
         key->contents = NULL;
+        key->length = 0;
     }
 }
 
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 4247524ae..6f7023f70 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2143,7 +2143,7 @@ pkinit_octetstring2key(krb5_context context,
         goto cleanup;
 
     key_block->length = keylength;
-    key_block->contents = calloc(keylength, sizeof(unsigned char *));
+    key_block->contents = malloc(keylength);
     if (key_block->contents == NULL) {
         retval = ENOMEM;
         goto cleanup;
@@ -2156,9 +2156,9 @@ pkinit_octetstring2key(krb5_context context,
 
 cleanup:
     free(buf);
-    if (retval && key_block->contents != NULL && key_block->length != 0) {
-        memset(key_block->contents, 0, key_block->length);
-        key_block->length = 0;
+    // If this is an error return, free the allocated keyblock, if any
+    if (retval) {
+        krb5_free_keyblock_contents(context, key_block);
     }
 
     return retval;