Ticket History #4566: leaks in preauth plugin support

From krb5-bugs-incoming-bounces@PCH.mit.edu Mon Oct 30 18:37:08 2006
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.9.3p2) with ESMTP
id SAA02615; Mon, 30 Oct 2006 18:37:07 -0500 (EST)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k9UNabev022521;
Mon, 30 Oct 2006 18:36:37 -0500
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
[18.7.21.83])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k9UMHPvL031674
for <krb5-bugs-incoming@PCH.mit.edu>; Mon, 30 Oct 2006 17:17:25 -0500
Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223])
by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id
k9UMHAqZ009044
for <krb5-bugs@mit.edu>; Mon, 30 Oct 2006 17:17:10 -0500 (EST)
Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31])
by mit.edu (Spam Firewall) with ESMTP id F085E2775E6
for <krb5-bugs@mit.edu>; Mon, 30 Oct 2006 17:17:09 -0500 (EST)
Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com
[172.16.52.254])
by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
k9UMH9JB011113
for <krb5-bugs@mit.edu>; Mon, 30 Oct 2006 17:17:09 -0500
Received: from localhost.localdomain (sparky.boston.redhat.com [172.16.80.55])
by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id
k9UMH8Eo024205
for <krb5-bugs@mit.edu>; Mon, 30 Oct 2006 17:17:09 -0500
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
by localhost.localdomain (8.13.8/8.13.8) with ESMTP id k9UM2lYY008021
for <krb5-bugs@mit.edu>; Mon, 30 Oct 2006 17:02:47 -0500
Received: (from nalin@localhost)
by localhost.localdomain (8.13.8/8.13.8/Submit) id k9UM2l29008020;
Mon, 30 Oct 2006 17:02:47 -0500
Date: Mon, 30 Oct 2006 17:02:47 -0500
From: Nalin Dahyabhai <nalin@redhat.com>
Message-Id: <200610302202.k9UM2l29008020@localhost.localdomain>
To: krb5-bugs@mit.edu
X-send-pr-version: 3.99
X-Spam-Score: 0.95
X-Spam-Flag: NO
X-Scanned-By: MIMEDefang 2.42
X-Mailman-Approved-At: Mon, 30 Oct 2006 18:36:36 -0500
X-BeenThere: krb5-bugs-incoming@mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: nalin@redhat.com
Sender: krb5-bugs-incoming-bounces@PCH.mit.edu
Errors-To: krb5-bugs-incoming-bounces@PCH.mit.edu



System: Linux sparky 2.6.18-1.2798.fc6 #1 SMP Mon Oct 16 14:37:32 EDT 2006 i686 athlon i386 GNU/Linux
Architecture: i686

The list of plugin vtables returned by krb5int_get_plugin_dir_data()
isn't getting freed, either in the client library or in the KDC.
Index: src/kdc/kdc_preauth.c
===================================================================
--- src/kdc/kdc_preauth.c (revision 18750)
+++ src/kdc/kdc_preauth.c (working copy)
@@ -349,6 +352,7 @@
* leave room for a terminator entry. */
preauth_systems = malloc(sizeof(krb5_preauth_systems) * (module_count + 1));
if (preauth_systems == NULL) {
+ krb5int_free_plugin_dir_data(preauth_plugins_ftables);
return ENOMEM;
}

@@ -414,6 +418,7 @@
}
}
}
+ krb5int_free_plugin_dir_data(preauth_plugins_ftables);
n_preauth_systems = k;
/* Add the end-of-list marker. */
preauth_systems[k].name = "[end]";
Index: src/lib/krb5/krb/preauth2.c
===================================================================
--- src/lib/krb5/krb/preauth2.c (revision 18750)
+++ src/lib/krb5/krb/preauth2.c (working copy)
@@ -167,11 +167,13 @@
/* allocate the space we need */
context = malloc(sizeof(*context));
if (context == NULL) {
+ krb5int_free_plugin_dir_data(tables);
return;
}
context->modules = malloc(sizeof(context->modules[0]) * n_modules);
if (context->modules == NULL) {
free(context);
+ krb5int_free_plugin_dir_data(tables);
return;
}
memset(context->modules, 0, sizeof(context->modules[0]) * n_modules);
@@ -216,6 +219,7 @@
}
}

+ krb5int_free_plugin_dir_data(tables);
/* return the result */
*preauth_context = context;
}

Modify the preath plugin interface so that a plugin's context is
global to all the modules within a plugin. Also, change the
client-side interface so that the preauth plugin context (once
created) lives the lifetime of a krb5_context. This will allow
future changes that can set plugin parameters. The client side
request context lives the lifetime of a call to krb5_get_init_creds().

Make the sample preauth plugins buildable outside the source tree.

Fix minor memory leak in sort_krb5_padata_sequence().

Add a prototype for krb5_do_preauth_tryagain() and change the plugin
interface.

Incorporates fixes from Nalin Dahyabhai <nalin@redhat.com> for leaks
of the function table pointers (rt #4566) and fix KDC crash (rt #4567)


Commit By: coffman



Revision: 18754
Changed Files:
U trunk/src/include/k5-int.h
U trunk/src/include/krb5/preauth_plugin.h
U trunk/src/kdc/kdc_preauth.c
U trunk/src/lib/krb5/krb/get_in_tkt.c
U trunk/src/lib/krb5/krb/init_ctx.c
U trunk/src/lib/krb5/krb/preauth2.c
U trunk/src/lib/krb5/os/init_os_ctx.c
U trunk/src/plugins/preauth/cksum_body/Makefile.in
A trunk/src/plugins/preauth/cksum_body/cksum_body_main.c
D trunk/src/plugins/preauth/cksum_body/src/cksum_body.c
U trunk/src/plugins/preauth/wpse/Makefile.in
D trunk/src/plugins/preauth/wpse/src/wpse.c
A trunk/src/plugins/preauth/wpse/wpse_main.c