From: Tom Yu <tlyu@mit.edu>
Date: Sat, 15 Dec 2007 01:22:56 +0000 (+0000)
Subject: pull up r20180 from trunk
X-Git-Tag: krb5-1.6.4-beta1~15
X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=b08ef98d8d333fa620d68b770e1070cdcf7e1936;p=krb5.git

pull up r20180 from trunk

 r20180@cathode-dark-space:  tlyu | 2007-12-14 00:01:07 -0500
 ticket: 5856
 target_version: 1.6.4
 tags: pullup

 fix CVE-2007-5971: double-free in gss_krb5int_make_seal_token_v3()


ticket: 5856
version_fixed: 1.6.4

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@20186 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c
index 2c084865e..5c3b8c005 100644
--- a/src/lib/gssapi/krb5/k5sealv3.c
+++ b/src/lib/gssapi/krb5/k5sealv3.c
@@ -248,7 +248,6 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
 	plain.data = 0;
 	if (err) {
 	    zap(outbuf,bufsize);
-	    free(outbuf);
 	    goto error;
 	}
 	if (sum.length != ctx->cksum_size)