From rt at krbdev.mit.edu  Fri Sep  4 19:31:42 2026
From: rt at krbdev.mit.edu (Greg Hudson via RT)
Date: Fri, 04 Sep 2026 19:31:42 -0400
Subject: [krbdev.mit.edu #9232] git commit
References: <RT-Ticket-9232@mit.edu>
Message-ID: <rt-4.4.3-2-3085563-1788564702-1752.9232-5-0@mit.edu>


<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9232 >


Prevent dangling result in tl_data2berval()

If the second malloc() fails in tl_data2berval(), do not leave a
dangling freed pointer in *out, or the caller will free it a second
time.  Reported by Vidal Segura Garc?a.

https://github.com/krb5/krb5/commit/6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d
Author: Greg Hudson <ghudson at mit.edu>
Commit: 6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d
Branch: master
 src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)


From rt-comment at krbdev.mit.edu  Fri Sep  4 19:47:57 2026
From: rt-comment at krbdev.mit.edu (Greg Hudson via RT)
Date: Fri, 04 Sep 2026 19:47:57 -0400
Subject: [krbdev.mit.edu #9235] git commit
References: <RT-Ticket-9235@mit.edu>
Message-ID: <rt-4.4.3-2-3087097-1788565677-121.9235-4-0@mit.edu>


Fri Sep 04 19:47:57 2026: Request 9235 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9235 >



Free small client memory leak on OTP failure

When an initial credentials request using FAST OTP fails due to a
rejection from the KDC, otp_client_prep_questions() may be called
during the processing of the PREAUTH_FAILED response, due to a minor
malfunction in the preauth logic (to be fixed separately).  When this
happens the OTP challenge in the PREAUTH_FAILED padata is decoded into
modreq, overwriting and leaking the decoded challenge from the
PREAUTH_REQUIRED response.

Although we don't expect multiple otp_client_prep_questions() calls
when the preauth logic is behaving properly, it could still happen due
to unexpected KDC behavior (such as a MORE_PREAUTH_DATA_REQUIRED
response).  Fix the leak in otp_client_prep_questions() so that it
isn't admitted under any KDC behavior.

https://github.com/krb5/krb5/commit/82a4224f07ad21c2a3e977c5c4651d7d30c6f1f0
Author: Greg Hudson <ghudson at mit.edu>
Commit: 82a4224f07ad21c2a3e977c5c4651d7d30c6f1f0
Branch: master
 src/lib/krb5/krb/preauth_otp.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)


From rt at krbdev.mit.edu  Fri Sep  4 20:00:07 2026
From: rt at krbdev.mit.edu (Greg Hudson via RT)
Date: Fri, 04 Sep 2026 20:00:07 -0400
Subject: [krbdev.mit.edu #9232] git commit
References: <RT-Ticket-9232@mit.edu>
Message-ID: <rt-4.4.3-2-3088794-1788566407-771.9232-5-0@mit.edu>


<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9232 >


Prevent dangling result in tl_data2berval()

If the second malloc() fails in tl_data2berval(), do not leave a
dangling freed pointer in *out, or the caller will free it a second
time.  Reported by Vidal Segura Garc?a.

(cherry picked from commit 6a880f5a629ccdfe9e5ecefc46b2186ba69bcc6d)

https://github.com/krb5/krb5/commit/5dbd6ba425eecf76396d2f78b79738983b255c20
Author: Greg Hudson <ghudson at mit.edu>
Commit: 5dbd6ba425eecf76396d2f78b79738983b255c20
Branch: krb5-1.22
 src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)


From rt at krbdev.mit.edu  Fri Sep  4 20:00:12 2026
From: rt at krbdev.mit.edu (Greg Hudson via RT)
Date: Fri, 04 Sep 2026 20:00:12 -0400
Subject: [krbdev.mit.edu #9235] git commit
References: <RT-Ticket-9235@mit.edu>
Message-ID: <rt-4.4.3-2-3088904-1788566412-1630.9235-5-0@mit.edu>


<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9235 >


Free small client memory leak on OTP failure

When an initial credentials request using FAST OTP fails due to a
rejection from the KDC, otp_client_prep_questions() may be called
during the processing of the PREAUTH_FAILED response, due to a minor
malfunction in the preauth logic (to be fixed separately).  When this
happens the OTP challenge in the PREAUTH_FAILED padata is decoded into
modreq, overwriting and leaking the decoded challenge from the
PREAUTH_REQUIRED response.

Although we don't expect multiple otp_client_prep_questions() calls
when the preauth logic is behaving properly, it could still happen due
to unexpected KDC behavior (such as a MORE_PREAUTH_DATA_REQUIRED
response).  Fix the leak in otp_client_prep_questions() so that it
isn't admitted under any KDC behavior.

(cherry picked from commit 82a4224f07ad21c2a3e977c5c4651d7d30c6f1f0)

https://github.com/krb5/krb5/commit/e689b5d54d90a45f4d03ccbdae40fb4037276ea7
Author: Greg Hudson <ghudson at mit.edu>
Commit: e689b5d54d90a45f4d03ccbdae40fb4037276ea7
Branch: krb5-1.22
 src/lib/krb5/krb/preauth_otp.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)