[krbdev.mit.edu #8871] git commit

"Greg Hudson via RT" <[email protected]>
Newsgroups gmane.comp.encryption.kerberos.bugs
Message-ID <[email protected]>
Tue Jan 28 12:02:07 2020: Request 8871 was acted upon.
 Transaction: Ticket created by [email protected]
       Queue: krb5
     Subject: git commit
       Owner: [email protected]
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8871 >



Zero length fields when freeing object contents

In krb5_free_data_contents() and krb5_free_checksum_contents(), zero
the length as well as the data pointer to leave the object in a valid
state.  Add asserts to existing test harnesses to verify the new
behavior.

In the krb5 GSS mech's kg_checksum_channel_bindings(), remove the code
to reallocate the checksum with xmalloc(), as it relied on
krb5_free_checksum_contents() leaving the object in an invalid state.
This code was added in commit a30fb4c4400f13a2690df7ef910b7ac0ccbcf194
to match an xfree() call, but commit
29337e7c7b796685fb6a03466d32147e17aa2d16 replaced that xfree() with a
krb5_free_checksum_contents().  (In addition, the xmalloc and xfree
wrappers never evolved to do anything beyond malloc and free.)

In kpropd's recv_database(), don't free outbuf until we are done using
its length.

[[email protected]: rewrote commit message; edited doxygen comment
changes to mention version]

https://github.com/krb5/krb5/commit/4a2c5d259f5a7eda0f0f9028c061fcd032a72de0
Author: Isaac Boukris <[email protected]>
Committer: Greg Hudson <[email protected]>
Commit: 4a2c5d259f5a7eda0f0f9028c061fcd032a72de0
Branch: master
 src/include/krb5/krb5.hin              |    4 ++++
 src/kprop/kpropd.c                     |    2 +-
 src/lib/crypto/crypto_tests/t_cksums.c |    1 +
 src/lib/gssapi/krb5/util_cksum.c       |   16 ----------------
 src/lib/krb5/krb/kfree.c               |    8 ++++----
 src/tests/rdreq.c                      |    2 ++
 6 files changed, 12 insertions(+), 21 deletions(-)
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.