From 441736872285e6538e6b6c78eab60862d3b6dcaa Mon Sep 17 00:00:00 2001 From: sashan Date: Sun, 29 May 2022 10:32:57 +0200 Subject: Fix uncommon PKINIT memory leak PKINIT per-request module data objects are normally created by pkinit_server_verify_padata() and freed by pkinit_server_return_padata(). In some unusual circumstances, the KDC may not call the return_padata method after verification succeeds. Add a free_modreq method and free the object there instead. [ghudson@mit.edu: rewrote commit message] (cherry picked from commit 883415036a4b4e0372b84a5a6e46c10b3a67aba0) ticket: 9065 version_fixed: 1.19.4 --- src/plugins/preauth/pkinit/pkinit_srv.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c index 3ae56c0..26fcccc 100644 --- a/src/plugins/preauth/pkinit/pkinit_srv.c +++ b/src/plugins/preauth/pkinit/pkinit_srv.c @@ -1026,7 +1026,6 @@ pkinit_server_return_padata(krb5_context context, (*send_pa)->contents = (krb5_octet *) out_data->data; cleanup: - pkinit_fini_kdc_req_context(context, reqctx); free(scratch.data); free(out_data); if (encoded_dhkey_info != NULL) @@ -1615,6 +1614,13 @@ pkinit_fini_kdc_req_context(krb5_context context, void *ctx) free(reqctx); } +static void +pkinit_free_modreq(krb5_context context, krb5_kdcpreauth_moddata moddata, + krb5_kdcpreauth_modreq modreq) +{ + pkinit_fini_kdc_req_context(context, modreq); +} + krb5_error_code kdcpreauth_pkinit_initvt(krb5_context context, int maj_ver, int min_ver, krb5_plugin_vtable vtable); @@ -1636,5 +1642,6 @@ kdcpreauth_pkinit_initvt(krb5_context context, int maj_ver, int min_ver, vt->edata = pkinit_server_get_edata; vt->verify = pkinit_server_verify_padata; vt->return_padata = pkinit_server_return_padata; + vt->free_modreq = pkinit_free_modreq; return 0; } -- cgit v1.1