From: Tom Yu <tlyu@mit.edu>
Date: Tue, 27 Feb 2007 22:41:24 +0000 (+0000)
Subject: pull up r19171 from trunk
X-Git-Tag: kfw-3.2.0-beta1~78
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=dea26f42726813e807d66e86c971e28285c668b3;p=krb5.git

pull up r19171 from trunk

 r19171@cathode-dark-space:  raeburn | 2007-02-23 19:56:23 -0500
 ticket: 5445
 status: open

 If a reflection is detected, zap the message buffer pointer output
 argument as well as actually freeing the buffer.  (Found while using
 the gsstest option to exercise error conditions.)


ticket: 5445

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@19186 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c
index 30845bd85..8c999868e 100644
--- a/src/lib/gssapi/krb5/k5unseal.c
+++ b/src/lib/gssapi/krb5/k5unseal.c
@@ -457,8 +457,11 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
 
     if ((ctx->initiate && direction != 0xff) ||
 	(!ctx->initiate && direction != 0)) {
-	if (toktype == KG_TOK_SEAL_MSG)
+	if (toktype == KG_TOK_SEAL_MSG) {
 	    xfree(token.value);
+	    message_buffer->value = NULL;
+	    message_buffer->length = 0;
+	}
 	*minor_status = G_BAD_DIRECTION;
 	return(GSS_S_BAD_SIG);
     }