krb5 commit: Fix gssalloc mismatches

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/e62bf3208f0ca622f63ecf01b186ebeafbe6eee5
commit e62bf3208f0ca622f63ecf01b186ebeafbe6eee5
Author: Greg Hudson <ghudson at mit.edu>
Date:   Mon Sep 21 22:41:51 2026 -0400

    Fix gssalloc mismatches
    
    Correct several mismatches where free() could be used on pointers
    allocated with gssalloc_malloc() or vice versa.  These mismatches are
    generally harmless, but could cause heap corruption with older
    versions of Visual Studio.  Discovered by Aisle Research.
    
    ticket: 9243 (new)
    tags: pullup
    target_version: 1.22-next

 src/lib/gssapi/mechglue/g_dsp_name_ext.c | 2 +-
 src/lib/gssapi/mechglue/g_dup_name.c     | 6 +++---
 src/lib/gssapi/mechglue/g_imp_name.c     | 3 +--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/lib/gssapi/mechglue/g_dsp_name_ext.c b/src/lib/gssapi/mechglue/g_dsp_name_ext.c
index be08dd16c..edb290b1f 100644
--- a/src/lib/gssapi/mechglue/g_dsp_name_ext.c
+++ b/src/lib/gssapi/mechglue/g_dsp_name_ext.c
@@ -120,7 +120,7 @@ gss_display_name_ext (OM_uint32 *minor_status,
         return GSS_S_UNAVAILABLE;
 
     if ((output_name_buffer->value =
-         malloc(union_name->external_name->length + 1)) == NULL) {
+         gssalloc_malloc(union_name->external_name->length + 1)) == NULL) {
         return GSS_S_FAILURE;
     }
     output_name_buffer->length = union_name->external_name->length;
diff --git a/src/lib/gssapi/mechglue/g_dup_name.c b/src/lib/gssapi/mechglue/g_dup_name.c
index bf6eb602e..8134457a4 100644
--- a/src/lib/gssapi/mechglue/g_dup_name.c
+++ b/src/lib/gssapi/mechglue/g_dup_name.c
@@ -55,7 +55,7 @@ gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t src_name,
 		   gss_name_t *dest_name)
 {
 		gss_union_name_t src_union, dest_union;
-		OM_uint32 major_status = GSS_S_FAILURE;
+		OM_uint32 major_status = GSS_S_FAILURE, tmp;
 
 	major_status = val_dup_name_args(minor_status, src_name, dest_name);
 	if (major_status != GSS_S_COMPLETE)
@@ -120,8 +120,8 @@ gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t src_name,
 allocation_failure:
 	if (dest_union) {
 		if (dest_union->external_name) {
-			if (dest_union->external_name->value)
-				free(dest_union->external_name->value);
+			(void) gss_release_buffer(&tmp,
+						  dest_union->external_name);
 			free(dest_union->external_name);
 		}
 		if (dest_union->name_type)
diff --git a/src/lib/gssapi/mechglue/g_imp_name.c b/src/lib/gssapi/mechglue/g_imp_name.c
index 65fa6c0fb..be41add2b 100644
--- a/src/lib/gssapi/mechglue/g_imp_name.c
+++ b/src/lib/gssapi/mechglue/g_imp_name.c
@@ -158,8 +158,7 @@ gss_import_name(OM_uint32 * minor_status, gss_buffer_t input_name_buffer,
 allocation_failure:
     if (union_name) {
 	if (union_name->external_name) {
-	    if (union_name->external_name->value)
-		free(union_name->external_name->value);
+	    (void) gss_release_buffer(&tmp, union_name->external_name);
 	    free(union_name->external_name);
 	}
 	if (union_name->name_type)