svn rev #25341: trunk/src/lib/gssapi/ generic/ krb5/

[hartmans@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=25341
Commit By: hartmans
Log Message:
gssalloc memory management for gss_buffer_set.

compiles, but untested

Signed-off-by: Kevin Wasserman <kevin.wasserman at painless-security.com>


Changed Files:
U   trunk/src/lib/gssapi/generic/gssapi_alloc.h
U   trunk/src/lib/gssapi/generic/util_buffer_set.c
U   trunk/src/lib/gssapi/krb5/naming_exts.c
Modified: trunk/src/lib/gssapi/generic/gssapi_alloc.h
===================================================================
--- trunk/src/lib/gssapi/generic/gssapi_alloc.h	2011-10-14 14:44:35 UTC (rev 25340)
+++ trunk/src/lib/gssapi/generic/gssapi_alloc.h	2011-10-14 14:46:57 UTC (rev 25341)
@@ -48,6 +48,16 @@
 #endif
 }
 
+static inline void *
+gssalloc_realloc(void *value, size_t size)
+{
+#if _WIN32
+    return HeapReAlloc(GetProcessHeap(), 0, value, size);
+#else
+    return realloc(value, size);
+#endif
+}
+
 static inline char *
 gssalloc_strdup(const char *str)
 {

Modified: trunk/src/lib/gssapi/generic/util_buffer_set.c
===================================================================
--- trunk/src/lib/gssapi/generic/util_buffer_set.c	2011-10-14 14:44:35 UTC (rev 25340)
+++ trunk/src/lib/gssapi/generic/util_buffer_set.c	2011-10-14 14:46:57 UTC (rev 25341)
@@ -38,7 +38,7 @@
 {
     gss_buffer_set_t set;
 
-    set = (gss_buffer_set_desc *) malloc(sizeof(*set));
+    set = (gss_buffer_set_desc *) gssalloc_malloc(sizeof(*set));
     if (set == GSS_C_NO_BUFFER_SET) {
         *minor_status = ENOMEM;
         return GSS_S_FAILURE;
@@ -71,7 +71,7 @@
     }
 
     set = *buffer_set;
-    set->elements = (gss_buffer_desc *)realloc(set->elements,
+    set->elements = (gss_buffer_desc *)gssalloc_realloc(set->elements,
                                                (set->count + 1) *
                                                sizeof(gss_buffer_desc));
     if (set->elements == NULL) {
@@ -81,7 +81,7 @@
 
     p = &set->elements[set->count];
 
-    p->value = malloc(member_buffer->length);
+    p->value = gssalloc_malloc(member_buffer->length);
     if (p->value == NULL) {
         *minor_status = ENOMEM;
         return GSS_S_FAILURE;
@@ -113,13 +113,13 @@
     }
 
     if ((*buffer_set)->elements != NULL) {
-        free((*buffer_set)->elements);
+        gssalloc_free((*buffer_set)->elements);
         (*buffer_set)->elements = NULL;
     }
 
     (*buffer_set)->count = 0;
 
-    free(*buffer_set);
+    gssalloc_free(*buffer_set);
     *buffer_set = GSS_C_NO_BUFFER_SET;
 
     return GSS_S_COMPLETE;

Modified: trunk/src/lib/gssapi/krb5/naming_exts.c
===================================================================
--- trunk/src/lib/gssapi/krb5/naming_exts.c	2011-10-14 14:44:35 UTC (rev 25340)
+++ trunk/src/lib/gssapi/krb5/naming_exts.c	2011-10-14 14:46:57 UTC (rev 25341)
@@ -231,15 +231,22 @@
         ;
 
     set->count = i;
-    set->elements = calloc(i, sizeof(gss_buffer_desc));
+    set->elements = gssalloc_calloc(i, sizeof(gss_buffer_desc));
     if (set->elements == NULL) {
         gss_release_buffer_set(&minor_status, &set);
         return ENOMEM;
     }
 
-    for (i = 0; i < set->count; i++) {
-        set->elements[i].length = data[i].length;
-        set->elements[i].value = data[i].data;
+    /*
+     * Copy last element first so data remains properly
+     * NULL-terminated in case of allocation failure
+     * in data_to_gss() on windows.
+     */
+    for (i = set->count-1; i >= 0; i--) {
+        if (data_to_gss(&data[i], &set->elements[i])) {
+            gss_release_buffer_set(&minor_status, &set);
+            return ENOMEM;
+        }
     }
 
     free(data);