Crash while trying to destroy memory cache with Heimdal 1.4.1rc2

Jaideep Padhye <[email protected]>
Newsgroups gmane.comp.encryption.kerberos.heimdal.general
Message-ID <[email protected]>
Hi,

I need some help in understanding the Heimdal KRB5 Memory cache usage.  
In the file 'lib/krb5/test_cc.c ', I see the following line in documentation. 

 93 /*
 94  * Check that a closed cc still keeps it data and that it's no longer
 95  * there when it's destroyed.
 96  */

This implies, that a KRB5 cache needs to be destroyed after it is close, or else it will retain the data.
But if you look at the code, it suggests that ref counting is done and the data is freed when you do a close.
The ref counting can be seen in the file 'lib/krb5/mcache.c ',  in following lines: 


171 static int
172 mcc_close_internal(krb5_mcache *m)
173 {
174     if (--m->refcnt != 0)
175       return 0;
176 
177     if (MISDEAD(m)) {
178       free (m->name);
179       return 1;
180     }
181     return 0;
182 }
183 
184 static krb5_error_code KRB5_CALLCONV
185 mcc_close(krb5_context context,
186         krb5_ccache id)
187 {
188     if (mcc_close_internal(MCACHE(id)))
189       krb5_data_free(&id->data);
190     return 0;
191 }

So I chose to still do a krb5_cc_destroy to make sure I'm not leaking memory in some other scenarios. 
But, when my class tries to do a krb5_cc_destroy() in the destructor, it hits an krb5_abortx() in the same file on following line numbers:

200     if (m->refcnt == 0)
201       krb5_abortx(context, "mcc_destroy: refcnt already 0");
202 


I need some help in understanding the use of KRB5 cache of type MEMORY.  Following are the specific questions I need help with:
1] Is Krb5 Mem cache data ref-counted or needs to be explicitly destroyed?
2] While destroying the object, should I use krb5_cc_close() or krb5_cc_destroy() or both?


Thanks,

Jaideep




Crash output:
==============
Program terminated with signal 3, Quit.
#0  0x00002b58818a6229 in raise () from /lib64/libpthread.so.0
#0  0x00002b58818a6229 in raise () from /lib64/libpthread.so.0
No symbol table info available.
#1  0x00002b58829740c5 in ?? () from /lib64/libunicorn-util.so
No symbol table info available.
#2  0x00002b58829743a4 in sigcore_handler () from /lib64/libunicorn-util.so
No symbol table info available.
#3  <signal handler called>
No symbol table info available.
#4  0x00002b588525bf83 in raise () from /lib64/libc.so.6
No symbol table info available.
#5  0x00002b588525d419 in abort () from /lib64/libc.so.6
No symbol table info available.
#6  0x00002b58841274e8 in krb5_abortx () from /usr/lib64/libkrb5.so.26
No symbol table info available.
#7  0x00002b58841104e1 in ?? () from /usr/lib64/libkrb5.so.26
No symbol table info available.
#8  0x00002b58840e361c in krb5_cc_destroy () from /usr/lib64/libkrb5.so.26
No symbol table info available.
#9  0x00002b5882dbb17c in waas_gssapi::CGssInfo::~CGssInfo () from /usr/
No symbol table info available.
#10 0x00000000005542be in ~CSecurityLayer (this=0x2aaab4318bf0) at /auto/wsj
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.