[krbdev.mit.edu #8697] Resource leak in krb5_gss_inquire_cred()

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[krbdev.mit.edu #8697] Resource leak in krb5_gss_inquire_cred()

Norm Green via RT
Hi Team,

krb5_gss_inquire_cred() in krb5-1.16.1/src/lib/gssapi/krb5/inq_cred.c
calls generic_gss_create_empty_oid_set() to create a empty oid set and store allocated memory to pointer "mechs"
but later if the code run into "goto fail", the storage mechs points to will not be freed when leaves this function.

The fix is to call gssalloc_free(mechs) in fail label.

Could someone help to take a look?

Thanks,
Bean

_______________________________________________
krb5-bugs mailing list
[hidden email]
https://mailman.mit.edu/mailman/listinfo/krb5-bugs