Double Free error in krb5_sendauth?

John Hascall john at iastate.edu
Mon Nov 19 08:27:40 EST 2007


Starting at line 102 of src/lib/krb5/krb/sendauth.c (V1.6.3)
we see:
                if ((retval = krb5_copy_principal(context, server,
                                                  &creds.server)))
                        goto error_return;
                if (client)
                        retval = krb5_copy_principal(context, client,
                                                     &creds.client);
                else
                        retval = krb5_cc_get_principal(context, use_ccache,
                                                       &creds.client);
                if (retval) {
                        krb5_free_principal(context, creds.server);
                        goto error_return;
     ...
error_return:
    krb5_free_cred_contents(context, &creds);


Does this not free creds.server twice
if krb5_copy_principal or (as in my case) krb5_cc_get_principal fails?


John



More information about the krbdev mailing list