diff options
| author | Tom Yu <tlyu@mit.edu> | 2005-07-12 19:56:56 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2005-07-12 19:56:56 +0000 |
| commit | 9755aac29ccaac6977a93aa4305963ac29748641 (patch) | |
| tree | aefd75bbc89cee3f463e37ba5a154b14a8712bc7 /src/kdc/do_as_req.c | |
| parent | 9ab48cb7d2150c1b0e427bbfcb4a310b29121431 (diff) | |
| download | krb5-9755aac29ccaac6977a93aa4305963ac29748641.zip krb5-9755aac29ccaac6977a93aa4305963ac29748641.tar.gz krb5-9755aac29ccaac6977a93aa4305963ac29748641.tar.bz2 | |
fix MITKRB5-SA-2005-002 KDC double-free and heap overflow
Fix for MITKRB5-SA-2005-002
* KDC double-free [CAN-2005-1174, VU#259798]
* krb5_unparse_name heap overflow [CAN-2005-1175, VU#885830]
Thanks to Daniel Wachdorf.
ticket: new
flags: pullup
target_version: 1.4.2
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17298 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/kdc/do_as_req.c')
| -rw-r--r-- | src/kdc/do_as_req.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index f292a17..2916cfe 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -523,6 +523,10 @@ prepare_error_as (krb5_kdc_req *request, int error, krb5_data *e_data, retval = krb5_mk_error(kdc_context, &errpkt, scratch); free(errpkt.text.data); - *response = scratch; + if (retval) + free(scratch); + else + *response = scratch; + return retval; } |