krb5 commit: Fix leak on error in process_chpw_request()

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/ed1c283551adf9eca4758efca70d3c1698f8a27c
commit ed1c283551adf9eca4758efca70d3c1698f8a27c
Author: Julien Rische <jrische at redhat.com>
Date:   Fri Sep 4 12:17:34 2026 +0200

    Fix leak on error in process_chpw_request()
    
    In process_chpw_request(), wipe the "clear" buffer before reusing it
    in the chpwfail label.
    
    [ghudson at mit.edu: removed conditionalization on wipe operation; edited
    comment; rewrote commit message]
    
    ticket: 9263 (new)
    tags: pullup
    target_version: 1.22-next

 src/kadmin/server/schpw.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index 5b73a3d8d..1d7183f7a 100644
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -272,6 +272,10 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
 
 chpwfail:
 
+    /* Wipe any decrypted data in clear if present, and reuse it for the error
+     * message plaintext. */
+    zapfree(clear.data, clear.length);
+    clear = empty_data();
     ret = alloc_data(&clear, 2 + strlen(strresult));
     if (ret)
         goto bailout;