[krbdev.mit.edu #8202] memory ccache cursors are invalidated by initialize

Greg Hudson via RT rt-comment at krbdev.mit.edu
Tue Jun 16 23:05:45 EDT 2015


Memory ccache objects contain a linked list of credentials.  The 
iteration cursor is a pointer to one of the list elements.  If the 
cache is initialized by one thread while another thread is iterating 
over it, the second thread's cursor contains a dangling pointer and the 
process will likely crash.

(This behavior can also be demonstrated in a single-threaded caller, 
but the caller would have to be doing something obtuse.)



More information about the krb5-bugs mailing list