krb5 commit: Prevent dangling result in tl_data2berval()

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d
commit 6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d
Author: Greg Hudson <ghudson at mit.edu>
Date:   Mon Aug 31 17:56:46 2026 -0400

    Prevent dangling result in tl_data2berval()
    
    If the second malloc() fails in tl_data2berval(), do not leave a
    dangling freed pointer in *out, or the caller will free it a second
    time.  Reported by Vidal Segura García.
    
    ticket: 9232
    tags: pullup
    target_version: 1.22-next

 src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 9aa68bacd..5bacaee28 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -628,20 +628,24 @@ cleanup:
 static krb5_error_code
 tl_data2berval (krb5_tl_data *in, struct berval **out)
 {
-    *out = (struct berval *) malloc (sizeof (struct berval));
-    if (*out == NULL)
-        return ENOMEM;
+    struct berval *bv;
 
-    (*out)->bv_len = in->tl_data_length + 2;
-    (*out)->bv_val =  (char *) malloc ((*out)->bv_len);
-    if ((*out)->bv_val == NULL) {
-        free (*out);
+    *out = NULL;
+
+    bv = malloc(sizeof(*bv));
+    if (bv == NULL)
+        return ENOMEM;
+    bv->bv_len = in->tl_data_length + 2;
+    bv->bv_val = malloc(bv->bv_len);
+    if (bv->bv_val == NULL) {
+        free(bv);
         return ENOMEM;
     }
 
-    STORE16_INT((*out)->bv_val, in->tl_data_type);
-    k5memcpy((*out)->bv_val + 2, in->tl_data_contents, in->tl_data_length);
+    STORE16_INT(bv->bv_val, in->tl_data_type);
+    k5memcpy(bv->bv_val + 2, in->tl_data_contents, in->tl_data_length);
 
+    *out = bv;
     return 0;
 }