[krbdev.mit.edu #9204] Passing a null pointer to memcpy and memmove with null size

Wed Apr 01 18:49:01 2026: Request 9204 was acted upon.
 Transaction: Ticket created by [email protected]
       Queue: krb5
     Subject: Passing a null pointer to memcpy and memmove with null size
       Owner: Nobody
  Requestors: [email protected]
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9204 >


Good day!

Using Address Sanitizer, I found several places in the codebase where a
null pointer could be passed to memcpy and memmove functions when the size
was zero. Formally it's undefined behavior. I also found that this issue
had already been fixed here:
Ticket History #9175: NULL pointer passing error in asn1_encode.c
<https://krbdev.mit.edu/rt/Ticket/History.html?id=9175>

Here are other places where I've found a similar problem:
https://github.com/krb5/krb5/blob/f8a0bee0a54ba0d96804631a3261ecd233051863/src/lib/crypto/krb/aead.c#L182
https://github.com/krb5/krb5/blob/f8a0bee0a54ba0d96804631a3261ecd233051863/src/lib/crypto/krb/aead.c#L214
https://github.com/krb5/krb5/blob/f8a0bee0a54ba0d96804631a3261ecd233051863/src/lib/krb5/krb/serialize.c#L70
https://github.com/krb5/krb5/blob/f8a0bee0a54ba0d96804631a3261ecd233051863/src/lib/gssapi/krb5/prf.c#L114
https://github.com/krb5/krb5/blob/f8a0bee0a54ba0d96804631a3261ecd233051863/src/plugins/kdb/db2/libdb2/btree/btree.h#L228
https://github.com/krb5/krb5/blob/f8a0bee0a54ba0d96804631a3261ecd233051863/src/kdc/rtest.c#L88

I also found a minor memory leak issue. We don't call the
krb5_free_cred_contents function for creds if we follow the label here:
https://github.com/krb5/krb5/blob/f8a0bee0a54ba0d96804631a3261ecd233051863/src/lib/gssapi/krb5/acquire_cred.c#L639

With respect,
Evgeny Shemyakin