Crash while freeing data.

[sasikumar bodathula]

Hi,
  I am using kerberos 1.11.2 version for development while using the pkinit option for certificate implementation observed a crash.

Steps followed:-

Set pkinit details using
krb5_get_init_creds_opt_set_pa -- set anchor and identity options.

 krb5_get_init_creds_password - with password as empty since in certificate password will not be supplied and password promter as NULL and other details as mentioned in the documentation.

Is this related to the data present in the certificates?

Certificates were generated with the steps mentioned in MIT site.


Crash point

 #0  0x00007f2f8c55129b in raise () from /lib64/libc.so.6
#1  0x00007f2f8c5527f3 in abort () from /lib64/libc.so.6
#2  0x00007f2f8c58dc28 in __libc_message () from /lib64/libc.so.6
#3  0x00007f2f8c5931b8 in malloc_printerr () from /lib64/libc.so.6
#4  0x00007f2f8c594d76 in free () from /lib64/libc.so.6
#5  0x00007f2f832b39aa in cms_signeddata_create (context=0x56a2400, plg_cryptoctx=0x56a4840, req_cryptoctx=0x56a4ca0, id_cryptoctx=0x56a4e50, cms_msg_type=0, 
    include_certchain=1, 
    data=0x56a56a0 "0|�<0:�\005\002\003\004�\205�\021\030\01720130521130048Z�\006\002\004T�\230\224�\026\004\024�\230EO\233�\025�Xi\207\231\n�2[�>T\225�\0160\f0\n\006\b*\206H\206�\r\003\a�,0*0\f�\n\006\b+\006\001\005\002\003\006\0020\f�\n\006\b+\006\001\005\002\003\006\0010\f�\n\006\b+\006\001\005\002\003\006\003", data_len=126, 
    signed_data=0x56a52b8, signed_data_len=0x56a52b4) at pkinit_crypto_openssl.c:1190
#6  0x00007f2f832ac79c in pkinit_as_req_create (context=0x56a2400, plgctx=0x56a47f0, reqctx=0x56a4de0, ctsec=1369141248, cusec=315781, nonce=1420859540, 
    cksum=0x5492900, client=0x56a4420, server=0x56a5160, as_req=0x5492928) at pkinit_clnt.c:374
#7  0x00007f2f832abfdd in pa_pkinit_gen_req (context=0x56a2400, plgctx=0x56a47f0, reqctx=0x56a4de0, request=0x56a4b80, pa_type=16, out_padata=0x5492a80, 
    prompter=0x409ab0 <krb5_prompter_posix at plt>, prompter_data=0x0, gic_opt=0x56a3170) at pkinit_clnt.c:157
#8  0x00007f2f832ade77 in pkinit_client_process (context=0x56a2400, moddata=0x56a47f0, modreq=0x56a4de0, gic_opt=0x56a3170, cb=0x7f2f8b1c2620, rock=0x56a4b08, 
    request=0x56a4b80, encoded_request_body=0x56a53a0, encoded_previous_request=0x0, in_padata=0x56a5110, prompter=0x409ab0 <krb5_prompter_posix at plt>, 
    prompter_data=0x0, out_padata=0x5492a80) at pkinit_clnt.c:1082
#9  0x00007f2f8af4587b in run_preauth_plugins (kcontext=0x56a2400, module_required_flags=1, request=0x56a4b80, encoded_request_body=0x56a53a0, 
    encoded_previous_request=0x0, in_padata=0x56a5110, prompter=0x409ab0 <krb5_prompter_posix at plt>, prompter_data=0x0, preauth_rock=0x56a4b08, out_pa_list=0x5492b50, 
    out_pa_list_size=0x5492b60, module_ret=0x5492b34, module_flags=0x5492b30, opte=0x56a3170) at preauth2.c:501

Best Regards,

B.Sasikumar.