gsasl: fix potential double free

[vszakats]

Also:

• require libgsasl 1.6.0+ (2010-12-14) for a gsasl_finish() that
  handles a NULL argument.
  Ref: https://gitlab.com/gsasl/gsasl/-/commit/b550032df8488a9ceaa3cfd4c634947d8f219717

Reported-by: Joshua Rogers (Aisle Research)

[vszakats]

@aisle-analyzer

[aisle-research-bot]

🔒 Aisle Security Analysis

✅ We scanned this PR and did not find any security vulnerabilities.
_{Aisle supplements but does not replace security review.}

---

Analyzed PR: #21609 at commit 1f709aa

_{Last updated on: 2026-05-14T13:21:52Z}

[Copilot]

Pull request overview

This PR hardens the libgsasl SCRAM integration in lib/vauth/ by preventing a potential double-free during error cleanup, and aligns documented minimum dependency versions with the new requirement.

Changes:

• Enforce libgsasl >= 1.6.0 at compile time to rely on gsasl_finish(NULL) being safe.
• Prevent a potential double-free by NULLing gsasl->ctx after gsasl_done() on gsasl_client_start() failure.
• Document the libgsasl minimum supported version in docs/INTERNALS.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
lib/vauth/gsasl.c	Adds a minimum libgsasl version guard and avoids double-free by clearing gsasl->ctx after teardown on error.
docs/INTERNALS.md	Documents libgsasl 1.6.0 (2010-12-14) as the minimum supported version.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.