diff options
| author | Isaac Boukris <iboukris@gmail.com> | 2020-01-26 21:49:47 +0100 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2020-01-28 10:59:32 -0500 |
| commit | 4a2c5d259f5a7eda0f0f9028c061fcd032a72de0 (patch) | |
| tree | 5fdad78a80b996d9d21a1b0752fd67931dac61c1 /src/kprop/kpropd.c | |
| parent | a5aa5969bc6ed404b86318b47c38dfc3d3aeb8df (diff) | |
| download | krb5-4a2c5d259f5a7eda0f0f9028c061fcd032a72de0.tar.gz | |
Zero length fields when freeing object contents
In krb5_free_data_contents() and krb5_free_checksum_contents(), zero
the length as well as the data pointer to leave the object in a valid
state. Add asserts to existing test harnesses to verify the new
behavior.
In the krb5 GSS mech's kg_checksum_channel_bindings(), remove the code
to reallocate the checksum with xmalloc(), as it relied on
krb5_free_checksum_contents() leaving the object in an invalid state.
This code was added in commit a30fb4c4400f13a2690df7ef910b7ac0ccbcf194
to match an xfree() call, but commit
29337e7c7b796685fb6a03466d32147e17aa2d16 replaced that xfree() with a
krb5_free_checksum_contents(). (In addition, the xmalloc and xfree
wrappers never evolved to do anything beyond malloc and free.)
In kpropd's recv_database(), don't free outbuf until we are done using
its length.
[ghudson@mit.edu: rewrote commit message; edited doxygen comment
changes to mention version]
ticket: 8871 (new)
Diffstat (limited to 'src/kprop/kpropd.c')
| -rw-r--r-- | src/kprop/kpropd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c index 5622d56e1..ab4a764aa 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c @@ -1412,7 +1412,6 @@ recv_database(krb5_context context, int fd, int database_fd, } n = write(database_fd, outbuf.data, outbuf.length); krb5_free_data_contents(context, &inbuf); - krb5_free_data_contents(context, &outbuf); if (n < 0) { snprintf(buf, sizeof(buf), "while writing database block starting at offset %d", @@ -1426,6 +1425,7 @@ recv_database(krb5_context context, int fd, int database_fd, send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); } received_size += outbuf.length; + krb5_free_data_contents(context, &outbuf); } /* OK, we've seen the entire file. Did we get too many bytes? */ |