krb5 commit [krb5-1.14]: Fix leaks on error in krb5 gss_acquire_cred()

[Tom Yu]

https://github.com/krb5/krb5/commit/843ffd81a9fc7899d9d3ee8615f054fbfa1b81a4
commit 843ffd81a9fc7899d9d3ee8615f054fbfa1b81a4
Author: Greg Hudson <ghudson at mit.edu>
Date:   Mon Jun 27 17:49:57 2016 -0400

    Fix leaks on error in krb5 gss_acquire_cred()
    
    In acquire_cred_context(), when releasing the partially constructed
    cred on error, make sure to free the password and impersonator fields,
    and to destroy the ccache if we created it.
    
    (cherry picked from commit ee7315964e52fe351ddb6884e0e8baf1ecce2144)
    
    ticket: 8437
    version_fixed: 1.14.4

 src/lib/gssapi/krb5/acquire_cred.c |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c
index 6e83fb9..4505ba5 100644
--- a/src/lib/gssapi/krb5/acquire_cred.c
+++ b/src/lib/gssapi/krb5/acquire_cred.c
@@ -847,8 +847,12 @@ krb_error_out:
 
 error_out:
     if (cred != NULL) {
-        if (cred->ccache)
-            krb5_cc_close(context, cred->ccache);
+        if (cred->ccache) {
+            if (cred->destroy_ccache)
+                krb5_cc_destroy(context, cred->ccache);
+            else
+                krb5_cc_close(context, cred->ccache);
+        }
         if (cred->client_keytab)
             krb5_kt_close(context, cred->client_keytab);
 #ifndef LEAN_CLIENT
@@ -859,6 +863,8 @@ error_out:
             krb5_rc_close(context, cred->rcache);
         if (cred->name)
             kg_release_name(context, &cred->name);
+        krb5_free_principal(context, cred->impersonator);
+        zapfreestr(cred->password);
         k5_mutex_destroy(&cred->lock);
         xfree(cred);
     }