Fix unlikely double free in PKINIT client code In pa_pkinit_gen_req, if the cleanup handler is reached with non-zero retval and non-null out_data, out_data is freed, then dereferenced, then freed again. This can only happen if one of the small fixed-size malloc requests fails after pkinit_as_req_create succeeds, so it is unlikely to occur in practice. https://github.com/krb5/krb5/commit/cc002d6c1ccfc08356d01ba83e72a46855d0302c Author: Greg Hudson Commit: cc002d6c1ccfc08356d01ba83e72a46855d0302c Branch: master src/plugins/preauth/pkinit/pkinit_clnt.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)