Ticket History #5475: Principal leak in kadm5_get_init_creds

The function kadm5_get_init_creds fails to release a principal before
exiting. The leak can be observed by running "valgrind
--leak-check=full kadmin". No actions are necessary; simply exit from
kadmin immediately and the leak is reported. Valgrind actually reports
a leak in _kadm5_init_any on my Fedora Core 6 machine, but the line
number points to a spot in kadm5_get_init_creds. I have inspected the
source code and verified that this leak exists in all 1.5 releases as
well as in the 1.6 release. I am attaching a patch to plug the leak.

--- src/lib/kadm5/clnt/client_init.c.ORIG 2006-05-15 19:45:00.000000000 -0600
+++ src/lib/kadm5/clnt/client_init.c 2007-03-03 19:57:26.000000000 -0700
@@ -410,7 +410,7 @@
strlen(krb5_cc_get_name(handle->context, ccache)) + 2);
if (handle->cache_name == NULL) {
code = ENOMEM;
- goto error;
+ goto error2;
}
sprintf(handle->cache_name, "%s:%s",
krb5_cc_get_type(handle->context, ccache),
@@ -425,11 +425,11 @@
code = krb5_cc_resolve(handle->context, handle->cache_name,
&ccache);
if (code)
- goto error;
+ goto error2;

code = krb5_cc_initialize (handle->context, ccache, client);
if (code)
- goto error;
+ goto error2;

handle->destroy_cache = 1;
}
@@ -451,6 +451,8 @@
if (code == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN)
code = KADM5_SECURE_PRINC_MISSING;

+error2:
+ krb5_free_principal(handle->context, client);
error:
if (ccache != NULL && init_type != INIT_CREDS)
krb5_cc_close(handle->context, ccache);

Regards,
--
Jerry James, Assistant Professor Jerry.James@usu.edu
Computer Science Department http://www.cs.usu.edu/~jerry/
Utah State University