From d82c7673f86e528c0bb1fc3f69f749ea9cec245c Mon Sep 17 00:00:00 2001
From: Russ Allbery <rra@stanford.edu>
Date: Mon, 12 Jun 2006 18:58:01 +0000
Subject: [PATCH] Always initialize the output token in gss_init_sec_context as
required by RFC 2744 section 5.19. The krb5 code did this but the generic
code didn't, causing a double-free in OpenSSH.
Ticket: 3086
Version_Reported: 1.3.6
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@18114 dc483132-0cff-0310-8789-dd5450dbe970
---
src/lib/gssapi/mechglue/g_init_sec_context.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/lib/gssapi/mechglue/g_init_sec_context.c b/src/lib/gssapi/mechglue/g_init_sec_context.c
index 4ff47f899..8f55ac5f4 100644
--- a/src/lib/gssapi/mechglue/g_init_sec_context.c
+++ b/src/lib/gssapi/mechglue/g_init_sec_context.c
@@ -77,6 +77,8 @@ OM_uint32 * time_rec;
gss_cred_id_t input_cred_handle;
gss_initialize();
+ output_token->length = 0;
+ output_token->value = NULL;
if (context_handle == NULL)
return GSS_S_NO_CONTEXT;
--
2.26.2