diff options
| author | Tom Yu <tlyu@mit.edu> | 2011-03-15 23:50:09 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2011-03-15 23:50:09 +0000 |
| commit | d8bec619e06cea9b25b54770764f3ead23cc5a09 (patch) | |
| tree | 64495968284e4a850f4ac05a9e9fa48b6090bd01 | |
| parent | c34804a019ce01c52684d52c2822ce2682af7c5d (diff) | |
| download | krb5-d8bec619e06cea9b25b54770764f3ead23cc5a09.zip krb5-d8bec619e06cea9b25b54770764f3ead23cc5a09.tar.gz krb5-d8bec619e06cea9b25b54770764f3ead23cc5a09.tar.bz2 | |
KDC double-free when PKINIT enabled [MITKRB5-SA-2011-003 CVE-2011-0284]
pull up r24705 from trunk
------------------------------------------------------------------------
r24705 | tlyu | 2011-03-15 17:47:19 -0400 (Tue, 15 Mar 2011) | 8 lines
ticket: 6881
subject: KDC double-free when PKINIT enabled [MITKRB5-SA-2011-003 CVE-2011-0284]
tags: pullup
target_version: 1.9.1
Fix a double-free condition in the KDC that can occur during an
AS-REQ when PKINIT is enabled.
ticket: 6882
status: resolved
version_fixed: 1.8.4
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24707 dc483132-0cff-0310-8789-dd5450dbe970
| -rw-r--r-- | src/kdc/do_as_req.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 3924297..4eb752c 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -784,6 +784,8 @@ prepare_error_as (struct kdc_request_state *rstate, krb5_kdc_req *request, pad->contents = td[size]->data; pad->length = td[size]->length; pa[size] = pad; + td[size]->data = NULL; + td[size]->length = 0; } krb5_free_typed_data(kdc_context, td); } |