From: Alexandra Ellwood <lxs@mit.edu>
Date: Thu, 10 Jul 2008 20:17:51 +0000 (+0000)
Subject: CCacheServer crashes iterating over creds which have been destroyed
X-Git-Tag: krb5-1.7-alpha1~602
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=c144ea40b4fa1dfa1fb405022bd92010c8cd018e;p=krb5.git

CCacheServer crashes iterating over creds which have been destroyed

ccs_list_release was trying to manually delete the iterators with a
broken for loop which skipped iterators.  Since the iterators were referenced
by the client, when the client exited it would tell the iterators to release
themselves.  The orphaned itertors would attempt to remove themselves from
their list (which had been released) resulting in a crash.

ticket: new

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20510 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/ccapi/server/ccs_list_internal.c b/src/ccapi/server/ccs_list_internal.c
index 07e5ee8d1..1a8d0c639 100644
--- a/src/ccapi/server/ccs_list_internal.c
+++ b/src/ccapi/server/ccs_list_internal.c
@@ -123,13 +123,8 @@ cc_int32 ccs_list_release (ccs_list_t io_list)
 {
     cc_int32 err = ccNoError;
     
-    if (!err && io_list) {
-        cc_uint64 i;
-        
-        for (i = 0; i < cci_array_count (io_list->iterators); i++) {
-            ccs_list_iterator_release ((ccs_list_iterator_t) cci_array_object_at_index (io_list->iterators, i));
-        }
-        free (io_list->iterators);
+    if (!err && io_list) {        
+        cci_array_release (io_list->iterators);
         cci_array_release (io_list->objects);
         free (io_list);
     }
@@ -220,6 +215,7 @@ static cc_int32 ccs_list_find_index (ccs_list_t        in_list,
             if (!err && equal) {
                 found = 1;
                 *out_object_index = i;
+                break;
             }
         }        
     }
@@ -279,6 +275,7 @@ static cc_int32 ccs_list_find_iterator_index (ccs_list_t        in_list,
             if (!err && equal) {
                 found = 1;
                 *out_object_index = i;
+                break;
             }
         }        
     }