svn rev #21688: branches/mskrb-integ/src/lib/krb5/krb/

[hartmans@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=21688
Commit By: hartmans
Log Message:
Patch from Luke Howard:
Confirm that copy succeeds before freeing ticket principal.


Changed Files:
U   branches/mskrb-integ/src/lib/krb5/krb/rd_req_dec.c
Modified: branches/mskrb-integ/src/lib/krb5/krb/rd_req_dec.c
===================================================================
--- branches/mskrb-integ/src/lib/krb5/krb/rd_req_dec.c	2009-01-03 21:43:09 UTC (rev 21687)
+++ branches/mskrb-integ/src/lib/krb5/krb/rd_req_dec.c	2009-01-03 21:43:14 UTC (rev 21688)
@@ -126,7 +126,9 @@
 	    retval = krb5_decrypt_tkt_part(context, &ktent.key,
 					   req->ticket);
 
-	    if (retval == 0 ) {
+	    if (retval == 0) {
+		krb5_principal tmp;
+
 		/*
 		 * We overwrite ticket->server to be the principal
 		 * that we match in the keytab.  The reason for doing
@@ -139,8 +141,11 @@
 		 * perhaps an API should be created to retrieve the
 		 * server as it appeared in the ticket.
 		 */
-		krb5_free_principal(context, req->ticket->server);
-		retval = krb5_copy_principal(context, ktent.principal, &req->ticket->server);
+		retval = krb5_copy_principal(context, ktent.principal, &tmp);
+		if (retval == 0) {
+		    krb5_free_principal(context, req->ticket->server);
+		    req->ticket->server = tmp;
+		}
 		(void) krb5_free_keytab_entry_contents(context, &ktent);
 		break;
 	    }