CCacheServer crashes iterating over creds which have been destroyed

ccs_list_release was trying to manually delete the iterators with a 
broken for loop which skipped iterators.  Since the iterators were referenced
by the client, when the client exited it would tell the iterators to release
themselves.  The orphaned itertors would attempt to remove themselves from
their list (which had been released) resulting in a crash.

ticket: new

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20510 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 4 insertions, 7 deletions

diff --git a/src/ccapi/server/ccs_list_internal.c b/src/ccapi/server/ccs_list_internal.c
index 07e5ee8..1a8d0c6 100644
--- a/src/ccapi/server/ccs_list_internal.c
+++ b/src/ccapi/server/ccs_list_internal.c
@@ -123,13 +123,8 @@ cc_int32 ccs_list_release (ccs_list_t io_list)
 {
     cc_int32 err = ccNoError;
     
-    if (!err && io_list) {
-        cc_uint64 i;
-        
-        for (i = 0; i < cci_array_count (io_list->iterators); i++) {
-            ccs_list_iterator_release ((ccs_list_iterator_t) cci_array_object_at_index (io_list->iterators, i));
-        }
-        free (io_list->iterators);
+    if (!err && io_list) {        
+        cci_array_release (io_list->iterators);
         cci_array_release (io_list->objects);
         free (io_list);
     }
@@ -220,6 +215,7 @@ static cc_int32 ccs_list_find_index (ccs_list_t        in_list,
             if (!err && equal) {
                 found = 1;
                 *out_object_index = i;
+                break;
             }
         }        
     }
@@ -279,6 +275,7 @@ static cc_int32 ccs_list_find_iterator_index (ccs_list_t        in_list,
             if (!err && equal) {
                 found = 1;
                 *out_object_index = i;
+                break;
             }
         }        
     }