59 lines
2.0 KiB
Diff
59 lines
2.0 KiB
Diff
From 441736872285e6538e6b6c78eab60862d3b6dcaa Mon Sep 17 00:00:00 2001
|
|
From: sashan <anedvedicky@gmail.com>
|
|
Date: Sun, 29 May 2022 10:32:57 +0200
|
|
Subject: [PATCH] Fix uncommon PKINIT memory leak
|
|
|
|
PKINIT per-request module data objects are normally created by
|
|
pkinit_server_verify_padata() and freed by
|
|
pkinit_server_return_padata(). In some unusual circumstances, the KDC
|
|
may not call the return_padata method after verification succeeds.
|
|
Add a free_modreq method and free the object there instead.
|
|
|
|
[ghudson@mit.edu: rewrote commit message]
|
|
|
|
(cherry picked from commit 883415036a4b4e0372b84a5a6e46c10b3a67aba0)
|
|
|
|
ticket: 9065
|
|
version_fixed: 1.19.4
|
|
|
|
---
|
|
src/plugins/preauth/pkinit/pkinit_srv.c | 9 ++++++++-
|
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
|
|
index 3ae56c0..26fcccc 100644
|
|
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
|
|
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
|
|
@@ -1026,7 +1026,6 @@ pkinit_server_return_padata(krb5_context context,
|
|
(*send_pa)->contents = (krb5_octet *) out_data->data;
|
|
|
|
cleanup:
|
|
- pkinit_fini_kdc_req_context(context, reqctx);
|
|
free(scratch.data);
|
|
free(out_data);
|
|
if (encoded_dhkey_info != NULL)
|
|
@@ -1615,6 +1614,13 @@ pkinit_fini_kdc_req_context(krb5_context context, void *ctx)
|
|
free(reqctx);
|
|
}
|
|
|
|
+static void
|
|
+pkinit_free_modreq(krb5_context context, krb5_kdcpreauth_moddata moddata,
|
|
+ krb5_kdcpreauth_modreq modreq)
|
|
+{
|
|
+ pkinit_fini_kdc_req_context(context, modreq);
|
|
+}
|
|
+
|
|
krb5_error_code
|
|
kdcpreauth_pkinit_initvt(krb5_context context, int maj_ver, int min_ver,
|
|
krb5_plugin_vtable vtable);
|
|
@@ -1636,5 +1642,6 @@ kdcpreauth_pkinit_initvt(krb5_context context, int maj_ver, int min_ver,
|
|
vt->edata = pkinit_server_get_edata;
|
|
vt->verify = pkinit_server_verify_padata;
|
|
vt->return_padata = pkinit_server_return_padata;
|
|
+ vt->free_modreq = pkinit_free_modreq;
|
|
return 0;
|
|
}
|
|
--
|
|
2.27.0
|
|
|