svn rev #23961: trunk/src/lib/ gssapi/krb5/ krb5/krb/

[ghudson@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=23961
Commit By: ghudson
Log Message:
Fix some bugs in the IAKERB code discovered by Coverity.  Also trim
down iakerb_initiator_step() a little using krb5_data constructors
and avoiding vertical function arguments.



Changed Files:
U   trunk/src/lib/gssapi/krb5/acquire_cred.c
U   trunk/src/lib/gssapi/krb5/iakerb.c
U   trunk/src/lib/krb5/krb/kfree.c
Modified: trunk/src/lib/gssapi/krb5/acquire_cred.c
===================================================================
--- trunk/src/lib/gssapi/krb5/acquire_cred.c	2010-04-30 21:22:48 UTC (rev 23960)
+++ trunk/src/lib/gssapi/krb5/acquire_cred.c	2010-05-01 17:53:04 UTC (rev 23961)
@@ -580,6 +580,7 @@
     if ((cred_usage != GSS_C_INITIATE) &&
         (cred_usage != GSS_C_ACCEPT) &&
         (cred_usage != GSS_C_BOTH)) {
+        ret = GSS_S_FAILURE;
         *minor_status = (OM_uint32) G_BAD_USAGE;
         goto error_out;
     }
@@ -685,16 +686,18 @@
         free(ret_mechs->elements);
         free(ret_mechs);
     }
-    if (cred->ccache)
-        (void)krb5_cc_close(context, cred->ccache);
+    if (cred != NULL) {
+        if (cred->ccache)
+            (void)krb5_cc_close(context, cred->ccache);
 #ifndef LEAN_CLIENT
-    if (cred->keytab)
-        (void)krb5_kt_close(context, cred->keytab);
+        if (cred->keytab)
+            (void)krb5_kt_close(context, cred->keytab);
 #endif /* LEAN_CLIENT */
-    if (cred->name)
-        kg_release_name(context, 0, &cred->name);
-    k5_mutex_destroy(&cred->lock);
-    xfree(cred);
+        if (cred->name)
+            kg_release_name(context, 0, &cred->name);
+        k5_mutex_destroy(&cred->lock);
+        xfree(cred);
+    }
     save_error_info(*minor_status, context);
     krb5_free_context(context);
     return ret;

Modified: trunk/src/lib/gssapi/krb5/iakerb.c
===================================================================
--- trunk/src/lib/gssapi/krb5/iakerb.c	2010-04-30 21:22:48 UTC (rev 23960)
+++ trunk/src/lib/gssapi/krb5/iakerb.c	2010-05-01 17:53:04 UTC (rev 23961)
@@ -517,33 +517,18 @@
                       const gss_buffer_t input_token,
                       gss_buffer_t output_token)
 {
-    krb5_error_code code;
-    krb5_data in, out, realm, *cookie = NULL;
+    krb5_error_code code = 0;
+    krb5_data in = empty_data(), out = empty_data(), realm = empty_data();
+    krb5_data *cookie = NULL;
     OM_uint32 tmp;
-    int initialContextToken = (input_token == GSS_C_NO_BUFFER);
     unsigned int flags = 0;
     krb5_ticket_times times;
 
     output_token->length = 0;
     output_token->value = NULL;
 
-    in.data = NULL;
-    in.length = 0;
-    out.data = NULL;
-    out.length = 0;
-    realm.data = NULL;
-    realm.length = 0;
-
-    if (initialContextToken) {
-        in.data = NULL;
-        in.length = 0;
-    } else {
-        code = iakerb_parse_token(ctx,
-                                  0,
-                                  input_token,
-                                  NULL,
-                                  &cookie,
-                                  &in);
+    if (input_token != GSS_C_NO_BUFFER) {
+        code = iakerb_parse_token(ctx, 0, input_token, NULL, &cookie, &in);
         if (code != 0)
             goto cleanup;
 

Modified: trunk/src/lib/krb5/krb/kfree.c
===================================================================
--- trunk/src/lib/krb5/krb/kfree.c	2010-04-30 21:22:48 UTC (rev 23960)
+++ trunk/src/lib/krb5/krb/kfree.c	2010-05-01 17:53:04 UTC (rev 23961)
@@ -922,6 +922,7 @@
 
     krb5_free_data_contents(context, &val->target_realm);
     krb5_free_data(context, val->cookie);
+    free(val);
 }
 
 void KRB5_CALLCONV
@@ -931,4 +932,5 @@
         return ;
 
     krb5_free_checksum_contents(context, &val->checksum);
+    free(val);
 }