diff options
| author | Julien Rische <jrische@redhat.com> | 2024-01-08 16:52:27 +0100 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2024-01-12 19:41:12 -0500 |
| commit | 5b00197227231943bd2305328c8260dd0b0dbcf0 (patch) | |
| tree | 7902577d3dfd27e7572f8f6fbe766fd685f2bfcb | |
| parent | 52fe67623b7205d91ceac855651e8c17f56b10c8 (diff) | |
| download | krb5-5b00197227231943bd2305328c8260dd0b0dbcf0.zip krb5-5b00197227231943bd2305328c8260dd0b0dbcf0.tar.gz krb5-5b00197227231943bd2305328c8260dd0b0dbcf0.tar.bz2 | |
Remove klist's defname global variable
Addition of a "cleanup" section in kinit's show_ccache() function as
part of commit 6c5471176f5266564fbc8a7e02f03b4b042202f8 introduced a
double-free bug, because defname is a global variable. After the
first call, successive calls may take place with a dangling pointer in
defname, which will be freed if krb5_cc_get_principal() fails.
Convert "defname" to a local variable initialized at the beginning of
show_ccache().
[ghudson@mit.edu: edited commit message]
| -rw-r--r-- | src/clients/klist/klist.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c index b5ae96a..b5808e5 100644 --- a/src/clients/klist/klist.c +++ b/src/clients/klist/klist.c @@ -53,7 +53,6 @@ int show_flags = 0, show_time = 0, status_only = 0, show_keys = 0; int show_etype = 0, show_addresses = 0, no_resolve = 0, print_version = 0; int show_adtype = 0, show_all = 0, list_all = 0, use_client_keytab = 0; int show_config = 0; -char *defname; char *progname; krb5_timestamp now; unsigned int timestamp_width; @@ -62,7 +61,7 @@ krb5_context context; static krb5_boolean is_local_tgt(krb5_principal princ, krb5_data *realm); static char *etype_string(krb5_enctype ); -static void show_credential(krb5_creds *); +static void show_credential(krb5_creds *, const char *); static void list_all_ccaches(void); static int list_ccache(krb5_ccache); @@ -473,6 +472,7 @@ show_ccache(krb5_ccache cache) krb5_creds creds; krb5_principal princ = NULL; krb5_error_code ret; + char *defname = NULL; int status = 1; ret = krb5_cc_get_principal(context, cache, &princ); @@ -503,7 +503,7 @@ show_ccache(krb5_ccache cache) } while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) { if (show_config || !krb5_is_config_principal(context, creds.server)) - show_credential(&creds); + show_credential(&creds, defname); krb5_free_cred_contents(context, &creds); } if (ret == KRB5_CC_END) { @@ -676,7 +676,7 @@ print_config_data(int col, krb5_data *data) } static void -show_credential(krb5_creds *cred) +show_credential(krb5_creds *cred, const char *defname) { krb5_error_code ret; krb5_ticket *tkt = NULL; |