Skip Menu |
 

Download (untitled) / with headers
text/plain 5.7KiB
From krb5-bugs-incoming-bounces@PCH.MIT.EDU Mon Aug 6 19:42:58 2007
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP
id l76NgwHW021368; Mon, 6 Aug 2007 19:42:58 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l76NgrTi005811;
Mon, 6 Aug 2007 19:42:53 -0400
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
[18.7.21.83])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l76NdZ07005272
for <krb5-bugs-incoming@PCH.mit.edu>; Mon, 6 Aug 2007 19:39:35 -0400
Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112])
by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id
l76NdXZ9015072
for <krb5-bugs@mit.edu>; Mon, 6 Aug 2007 19:39:33 -0400 (EDT)
Received: from ptb-relay03.plus.net (ptb-relay03.plus.net [212.159.14.214])
(using TLSv1 with cipher AES256-SHA (256/256 bits))
(No client certificate requested)
by mit.edu (Spam Firewall) with ESMTP id 4C5D16DCD72
for <krb5-bugs@mit.edu>; Mon, 6 Aug 2007 19:39:32 -0400 (EDT)
Received: from [81.174.172.105] (helo=opensuse.suse.home)
by ptb-relay03.plus.net with esmtp (Exim) id 1IICAa-00067M-JK
for krb5-bugs@mit.edu; Tue, 07 Aug 2007 00:39:28 +0100
Received: by opensuse.suse.home (Postfix, from userid 1000)
id D6ED1B840A; Tue, 7 Aug 2007 00:39:07 +0100 (BST)
To: krb5-bugs@mit.edu
From: huaraz@moeller.plus.com
X-send-pr-version: 3.99
Message-Id: <20070806233907.D6ED1B840A@opensuse.suse.home>
Date: Tue, 7 Aug 2007 00:39:07 +0100 (BST)
X-Spam-Score: 2.002
X-Spam-Level: ** (2.002)
X-Spam-Flag: NO
X-Scanned-By: MIMEDefang 2.42
X-Mailman-Approved-At: Mon, 06 Aug 2007 19:42:51 -0400
X-BeenThere: krb5-bugs-incoming@mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: huaraz@moeller.plus.com
Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU


Show quoted text
>Submitter-Id: net
>Originator: Markus Moeller
>Organization: privat
>Confidential: no
>Synopsis: gss_init_sec_context does not release output token buffer when used with spnego mech
>Severity: non-critical
>Priority: medium
>Category: krb5-libs
>Class: sw-bug
>Release: 1.6.1
>Environment: i686 GNU/Linux
System: Linux OpenSuse 2.6.18.8-0.3-default #1 SMP Tue Apr 17 08:42:35 UTC 2007 i686 i686 i386 GNU/Linux
Architecture: i686

Show quoted text
>Description: When creating gss context for spnego mechanism the output token is not released
>How-To-Repeat: Use following code

static gss_OID_desc _gss_mech_spnego = {6, (void
*)"\x2b\x06\x01\x05\x05\x02"};
gss_OID gss_mech_spnego = &_gss_mech_spnego;

const char *create_token(int spnego, const char *server) {
OM_uint32 major_status, minor_status;
gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
gss_name_t server_name = GSS_C_NO_NAME;
gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
const char *token = NULL;

setbuf(stdout,NULL);
setbuf(stdin,NULL);

if (!server) {
fprintf(stderr, "%s| %s: Error: No server name\n", LogTime(), PROGRAM);
return NULL;
}

service.value = malloc(strlen("HTTP")+strlen(server)+2);
snprintf(service.value,strlen("HTTP")+strlen(server)+2,"%s@%s","HTTP",server);
service.length = strlen((char *)service.value);

major_status = gss_import_name(&minor_status, &service,
gss_nt_service_name, &server_name);

if (check_gss_err(major_status,minor_status,"gss_import_name()") )
goto cleanup;
if (spnego) {
major_status = gss_init_sec_context(&minor_status,
GSS_C_NO_CREDENTIAL,
&gss_context,
server_name,
gss_mech_spnego,
0,
0,
GSS_C_NO_CHANNEL_BINDINGS,
&input_token,
NULL,
&output_token,
NULL,
NULL);
} else {
major_status = gss_init_sec_context(&minor_status,
GSS_C_NO_CREDENTIAL,
&gss_context,
server_name,
GSS_C_NO_OID,
0,
0,
GSS_C_NO_CHANNEL_BINDINGS,
&input_token,
NULL,
&output_token,
NULL,
NULL);
}
if (check_gss_err(major_status,minor_status,"gss_init_sec_context()") )
goto cleanup;

if (output_token.length) {

token = "OK";
}


cleanup:
gss_delete_sec_context(&minor_status, &gss_context, NULL);
gss_release_buffer(&minor_status, &service);
gss_release_buffer(&minor_status, &input_token);
gss_release_buffer(&minor_status, &output_token);
gss_release_name(&minor_status, &server_name);

return token;
}
int main(int argc, char *argv[]) {

const char *Token;
int opt,i=10;
int spnego=0;

while (-1 != (opt = getopt(argc, argv, "s"))) {
switch (opt) {
case 's':
spnego = 1;
break;
default:
fprintf(stderr, "%s| %s: unknown option: -%c.\n", LogTime(), PROGRAM, opt);
}
}

fprintf(stdout,"Spnego : %d\n",spnego);
while (i--) {
Token = (const char *)create_token(spnego,"w2k3.windows2003.home");
fprintf(stdout,"Token: %s\n",Token);
}
return(0);
}



Show quoted text
>Fix: None
From: tlyu@mit.edu
Subject: SVN Commit
Release mechtok_out in spnego_gss_init_sec_context.
Reported by Markus Moeller.


Commit By: tlyu



Revision: 19757
Changed Files:
_U trunk/
U trunk/src/lib/gssapi/spnego/spnego_mech.c
To: rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #5629] gss_init_sec_context does not release output token buffer when used with spnego mech
From: Tom Yu <tlyu@MIT.EDU>
Date: Tue, 07 Aug 2007 16:14:55 -0400
RT-Send-Cc:
Please try the following patch and let us know if it resolves the
output token buffer leak.

Index: src/lib/gssapi/spnego/spnego_mech.c
===================================================================
--- src/lib/gssapi/spnego/spnego_mech.c (revision 19756)
+++ src/lib/gssapi/spnego/spnego_mech.c (revision 19757)
@@ -835,6 +835,7 @@
ret = GSS_S_FAILURE;
}
}
+ gss_release_buffer(tmpmin, &mechtok_out);
if (ret == GSS_S_COMPLETE) {
/*
* Now, switch the output context to refer to the
From: "Markus Moeller" <huaraz@moeller.plus.com>
To: <rt-comment@krbdev.mit.edu>
Subject: Re: [krbdev.mit.edu #5629] gss_init_sec_context does not release output token buffer when used with spnego mech
Date: Wed, 8 Aug 2007 00:02:14 +0100
RT-Send-Cc:
Download (untitled) / with headers
text/plain 1.5KiB
Tom,

yes that solves this one:

==9846== 1,282 bytes in 1 blocks are definitely lost in loss record 35 of 36
==9846== at 0x40235B5: malloc (in
/usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==9846== by 0x4046673: make_ap_req_v1 (init_sec_context.c:320)
==9846== by 0x4046D74: new_connection (init_sec_context.c:561)
==9846== by 0x4047C95: krb5_gss_init_sec_context (init_sec_context.c:943)
==9846== by 0x404D080: k5glue_init_sec_context (krb5_gss_glue.c:675)
==9846== by 0x403473E: gss_init_sec_context (g_init_sec_context.c:211)
==9846== by 0x4052DA9: init_ctx_call_init (spnego_mech.c:687)
==9846== by 0x4052FF9: spnego_gss_init_sec_context (spnego_mech.c:801)
==9846== by 0x403473E: gss_init_sec_context (g_init_sec_context.c:211)

Markus

Show quoted text
----- Original Message -----
From: "Tom Yu via RT" <rt-comment@krbdev.mit.edu>
To: <huaraz@moeller.plus.com>
Sent: Tuesday, August 07, 2007 9:15 PM
Subject: Re: [krbdev.mit.edu #5629] gss_init_sec_context does not release
output token buffer when used with spnego mech


> Please try the following patch and let us know if it resolves the
> output token buffer leak.
>
> Index: src/lib/gssapi/spnego/spnego_mech.c
> ===================================================================
> --- src/lib/gssapi/spnego/spnego_mech.c (revision 19756)
> +++ src/lib/gssapi/spnego/spnego_mech.c (revision 19757)
> @@ -835,6 +835,7 @@
> ret = GSS_S_FAILURE;
> }
> }
> + gss_release_buffer(tmpmin, &mechtok_out);
> if (ret == GSS_S_COMPLETE) {
> /*
> * Now, switch the output context to refer to the
>
>
>
From: tlyu@mit.edu
Subject: SVN Commit
pull up r19757 from trunk

r19757@cathode-dark-space: tlyu | 2007-08-07 16:13:11 -0400
ticket: 5629
version_reported: 1.6.1
target_version: 1.6.3
tags: pullup

Release mechtok_out in spnego_gss_init_sec_context.
Reported by Markus Moeller.




Commit By: tlyu



Revision: 19902
Changed Files:
_U branches/krb5-1-6/
U branches/krb5-1-6/src/lib/gssapi/spnego/spnego_mech.c