Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.427 (Entity 5.427)
From: tlyu@mit.edu
Subject: git commit
RT-Send-CC:
X-RT-Original-Encoding: iso-8859-1
Content-Length: 746


Fix unlikely double free in PKINIT client code

In pa_pkinit_gen_req, if the cleanup handler is reached with non-zero
retval and non-null out_data, out_data is freed, then dereferenced,
then freed again.  This can only happen if one of the small fixed-size
malloc requests fails after pkinit_as_req_create succeeds, so it is
unlikely to occur in practice.

(cherry picked from commit cc002d6c1ccfc08356d01ba83e72a46855d0302c)

https://github.com/krb5/krb5/commit/68844329ad7d555e2c8dce9762b042f4b8f0ced1
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: 68844329ad7d555e2c8dce9762b042f4b8f0ced1
Branch: krb5-1.12
 src/plugins/preauth/pkinit/pkinit_clnt.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)