svn rev #24705: trunk/src/kdc/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24705
Commit By: tlyu
Log Message:
ticket: 6881
subject: KDC double-free when PKINIT enabled [MITKRB5-SA-2011-003 CVE-2011-0284]
tags: pullup
target_version: 1.9.1

Fix a double-free condition in the KDC that can occur during an
AS-REQ when PKINIT is enabled.


Changed Files:
U   trunk/src/kdc/do_as_req.c
Modified: trunk/src/kdc/do_as_req.c
===================================================================
--- trunk/src/kdc/do_as_req.c	2011-03-15 19:02:32 UTC (rev 24704)
+++ trunk/src/kdc/do_as_req.c	2011-03-15 21:47:19 UTC (rev 24705)
@@ -740,6 +740,8 @@
                     pad->contents = td[size]->data;
                     pad->length = td[size]->length;
                     pa[size] = pad;
+                    td[size]->data = NULL;
+                    td[size]->length = 0;
                 }
             krb5_free_typed_data(kdc_context, td);
         }