Skip to content

Commit

Permalink
Fix possible double-free during KDB creation
Browse files Browse the repository at this point in the history
In krb5_dbe_def_encrypt_key_data(), when we free
key_data->key_data_contents[0], reset it to null so the caller doesn't
free it as well.

Since commit a06945b this bug
manifests as a double-free during KDB creation if master key
encryption fails.

[ghudson@mit.edu: edited commit message]

(cherry picked from commit fddd419)

ticket: 9086
version_fixed: 1.20.2
  • Loading branch information
jrisc authored and greghudson committed Jul 6, 2023
1 parent eb886f6 commit 81a2265
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions src/lib/kdb/encrypt_key.c
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,7 @@ krb5_dbe_def_encrypt_key_data( krb5_context context,
if ((retval = krb5_c_encrypt(context, mkey, /* XXX */ 0, 0,
&plain, &cipher))) {
free(key_data->key_data_contents[0]);
key_data->key_data_contents[0] = NULL;
return retval;
}

Expand All @@ -121,6 +122,7 @@ krb5_dbe_def_encrypt_key_data( krb5_context context,
key_data->key_data_contents[1] = malloc(keysalt->data.length);
if (key_data->key_data_contents[1] == NULL) {
free(key_data->key_data_contents[0]);
key_data->key_data_contents[0] = NULL;
return ENOMEM;
}
memcpy(key_data->key_data_contents[1], keysalt->data.data,
Expand Down

0 comments on commit 81a2265

Please sign in to comment.