[krbdev.mit.edu #9016] Memory leak in krb5_gss_inquire_cred
"Sergio Gelato via RT" <[email protected]> Fri, 16 Jul 2021 12:01:58 -0400
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <rt-4.4.3-2-4139549-1626451318-286.9016-4-0@kerborg-prod-app-1.mit.edu> |
Fri Jul 16 12:01:58 2021: Request 9016 was acted upon. Transaction: Ticket created by [email protected] Queue: krb5 Subject: Memory leak in krb5_gss_inquire_cred Owner: Nobody Requestors: [email protected] Status: new Ticket <URL: http://kerborg-prod-app-1.mit.edu/rt/Ticket/Display.html?id=9016 > (I reported this one to Debian yesterday, #991140 there, but since you still accept bug reports from people without a GitHub account and it seems to be still unfixed in master, here it is directly.) krb5_gss_inquire_cred() doesn't release the default credential on success when called with GSS_C_NO_CREDENTIAL. Patch attached. _______________________________________________ krb5-bugs mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/krb5-bugs
fix-inq_cred-leak.patch
(text/x-diff, 1 KB)
Author: Sergio Gelato <[email protected]> Date: Wed Jul 14 20:21:29 UTC 2021 Subject: Plug leak in krb5_gss_inquire_cred Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 added an assignment to cred_handle but didn't update the cleanup code accordingly. This results in a leak on every call with GSS_C_NO_CREDENTIAL. We solve this by analogy with the changes to krb5_gss_init_sec_context_ext() and to the error cleanup block of krb5_gss_inquire_cred() by the same commit. Index: krb5-1.17/src/lib/gssapi/krb5/inq_cred.c =================================================================== --- krb5-1.17.orig/src/lib/gssapi/krb5/inq_cred.c 2019-01-08 17:02:37.000000000 +0100 +++ krb5-1.17/src/lib/gssapi/krb5/inq_cred.c 2021-07-14 22:19:40.022773499 +0200 @@ -197,8 +197,7 @@ mechs = GSS_C_NO_OID_SET; } - if (cred_handle == GSS_C_NO_CREDENTIAL) - krb5_gss_release_cred(minor_status, (gss_cred_id_t *)&cred); + krb5_gss_release_cred(minor_status, &defcred); krb5_free_context(context); *minor_status = 0;