krb5 commit [krb5-1.22]: Fix leak on error in process_chpw_request()

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/ccb5c1c41a3eb24c7e3fb39066e43ae5bec0fb69
commit ccb5c1c41a3eb24c7e3fb39066e43ae5bec0fb69
Author: Julien Rische <jrische at redhat.com>
Date:   Fri Sep 4 12:17:34 2026 +0200

    Fix leak on error in process_chpw_request()
    
    In process_chpw_request(), wipe the "clear" buffer before reusing it
    in the chpwfail label.
    
    [ghudson at mit.edu: removed conditionalization on wipe operation; edited
    comment; rewrote commit message]
    
    (cherry picked from commit ed1c283551adf9eca4758efca70d3c1698f8a27c)
    
    ticket: 9263
    version_fixed: 1.22.3

 src/kadmin/server/schpw.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index 5b73a3d8d..1d7183f7a 100644
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -272,6 +272,10 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
 
 chpwfail:
 
+    /* Wipe any decrypted data in clear if present, and reuse it for the error
+     * message plaintext. */
+    zapfree(clear.data, clear.length);
+    clear = empty_data();
     ret = alloc_data(&clear, 2 + strlen(strresult));
     if (ret)
         goto bailout;