From: Ken Raeburn <raeburn@mit.edu>
Date: Mon, 22 Mar 2004 22:00:02 +0000 (+0000)
Subject: * network.c (delete_fd): Free pointed-to data after removing it from the
X-Git-Tag: krb5-1.4-beta1~521
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=83840111486de395b53444388e241a62bec67cc4;p=krb5.git

* network.c (delete_fd): Free pointed-to data after removing it from the
connection set.
(kill_tcp_connection): Move delete_fd call to the end.
(accept_tcp_connection): Decrement connection counter again if we drop the
incoming connection for lack of buffer space.

ticket: 2384
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@16201 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/kdc/ChangeLog b/src/kdc/ChangeLog
index a5a6e39f4..996aa442a 100644
--- a/src/kdc/ChangeLog
+++ b/src/kdc/ChangeLog
@@ -1,3 +1,11 @@
+2004-03-22  Ken Raeburn  <raeburn@mit.edu>
+
+	* network.c (delete_fd): Free pointed-to data after removing it
+	from the connection set.
+	(kill_tcp_connection): Move delete_fd call to the end.
+	(accept_tcp_connection): Decrement connection counter again if we
+	drop the incoming connection for lack of buffer space.
+
 2004-03-15  Sam Hartman  <hartmans@mit.edu>
 
 	* kdc_preauth.c (verify_sam_response): Free unparsed names
diff --git a/src/kdc/network.c b/src/kdc/network.c
index cc79b8093..ddbdf3533 100644
--- a/src/kdc/network.c
+++ b/src/kdc/network.c
@@ -328,8 +328,9 @@ delete_fd (struct connection *xconn)
     FOREACH_ELT(connections, i, conn)
 	if (conn == xconn) {
 	    DEL(connections, i);
-	    return;
+	    break;
 	}
+    free(xconn);
 }
 
 static int
@@ -844,6 +845,7 @@ static void accept_tcp_connection(struct connection *conn, const char *prog,
 		newconn->u.tcp.addrbuf);
 	delete_fd(newconn);
 	close(s);
+	tcp_data_counter--;
 	return;
     }
     newconn->u.tcp.offset = 0;
@@ -860,7 +862,6 @@ static void accept_tcp_connection(struct connection *conn, const char *prog,
 static void
 kill_tcp_connection(struct connection *conn)
 {
-    delete_fd(conn);
     if (conn->u.tcp.response)
 	krb5_free_data(kdc_context, conn->u.tcp.response);
     if (conn->u.tcp.buffer)
@@ -876,6 +877,7 @@ kill_tcp_connection(struct connection *conn)
 	    sstate.max--;
     close(conn->fd);
     conn->fd = -1;
+    delete_fd(conn);
     tcp_data_counter--;
 }