Ticket History #5629: gss_init_sec_context does not release output token buffer when used with spnego mech

From krb5-bugs-incoming-bounces@PCH.MIT.EDU Mon Aug 6 19:42:58 2007
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP
id l76NgwHW021368; Mon, 6 Aug 2007 19:42:58 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l76NgrTi005811;
Mon, 6 Aug 2007 19:42:53 -0400
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
[18.7.21.83])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l76NdZ07005272
for <krb5-bugs-incoming@PCH.mit.edu>; Mon, 6 Aug 2007 19:39:35 -0400
Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112])
by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id
l76NdXZ9015072
for <krb5-bugs@mit.edu>; Mon, 6 Aug 2007 19:39:33 -0400 (EDT)
Received: from ptb-relay03.plus.net (ptb-relay03.plus.net [212.159.14.214])
(using TLSv1 with cipher AES256-SHA (256/256 bits))
(No client certificate requested)
by mit.edu (Spam Firewall) with ESMTP id 4C5D16DCD72
for <krb5-bugs@mit.edu>; Mon, 6 Aug 2007 19:39:32 -0400 (EDT)
Received: from [81.174.172.105] (helo=opensuse.suse.home)
by ptb-relay03.plus.net with esmtp (Exim) id 1IICAa-00067M-JK
for krb5-bugs@mit.edu; Tue, 07 Aug 2007 00:39:28 +0100
Received: by opensuse.suse.home (Postfix, from userid 1000)
id D6ED1B840A; Tue, 7 Aug 2007 00:39:07 +0100 (BST)
To: krb5-bugs@mit.edu
From: huaraz@moeller.plus.com
X-send-pr-version: 3.99
Message-Id: <20070806233907.D6ED1B840A@opensuse.suse.home>
Date: Tue, 7 Aug 2007 00:39:07 +0100 (BST)
X-Spam-Score: 2.002
X-Spam-Level: ** (2.002)
X-Spam-Flag: NO
X-Scanned-By: MIMEDefang 2.42
X-Mailman-Approved-At: Mon, 06 Aug 2007 19:42:51 -0400
X-BeenThere: krb5-bugs-incoming@mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: huaraz@moeller.plus.com
Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU


System: Linux OpenSuse 2.6.18.8-0.3-default #1 SMP Tue Apr 17 08:42:35 UTC 2007 i686 i686 i386 GNU/Linux
Architecture: i686


static gss_OID_desc _gss_mech_spnego = {6, (void
*)"\x2b\x06\x01\x05\x05\x02"};
gss_OID gss_mech_spnego = &_gss_mech_spnego;

const char *create_token(int spnego, const char *server) {
OM_uint32 major_status, minor_status;
gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
gss_name_t server_name = GSS_C_NO_NAME;
gss_buffer_desc service = GSS_C_EMPTY_BUFFER;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
const char *token = NULL;

setbuf(stdout,NULL);
setbuf(stdin,NULL);

if (!server) {
fprintf(stderr, "%s| %s: Error: No server name\n", LogTime(), PROGRAM);
return NULL;
}

service.value = malloc(strlen("HTTP")+strlen(server)+2);
snprintf(service.value,strlen("HTTP")+strlen(server)+2,"%s@%s","HTTP",server);
service.length = strlen((char *)service.value);

major_status = gss_import_name(&minor_status, &service,
gss_nt_service_name, &server_name);

if (check_gss_err(major_status,minor_status,"gss_import_name()") )
goto cleanup;
if (spnego) {
major_status = gss_init_sec_context(&minor_status,
GSS_C_NO_CREDENTIAL,
&gss_context,
server_name,
gss_mech_spnego,
0,
0,
GSS_C_NO_CHANNEL_BINDINGS,
&input_token,
NULL,
&output_token,
NULL,
NULL);
} else {
major_status = gss_init_sec_context(&minor_status,
GSS_C_NO_CREDENTIAL,
&gss_context,
server_name,
GSS_C_NO_OID,
0,
0,
GSS_C_NO_CHANNEL_BINDINGS,
&input_token,
NULL,
&output_token,
NULL,
NULL);
}
if (check_gss_err(major_status,minor_status,"gss_init_sec_context()") )
goto cleanup;

if (output_token.length) {

token = "OK";
}


cleanup:
gss_delete_sec_context(&minor_status, &gss_context, NULL);
gss_release_buffer(&minor_status, &service);
gss_release_buffer(&minor_status, &input_token);
gss_release_buffer(&minor_status, &output_token);
gss_release_name(&minor_status, &server_name);

return token;
}
int main(int argc, char *argv[]) {

const char *Token;
int opt,i=10;
int spnego=0;

while (-1 != (opt = getopt(argc, argv, "s"))) {
switch (opt) {
case 's':
spnego = 1;
break;
default:
fprintf(stderr, "%s| %s: unknown option: -%c.\n", LogTime(), PROGRAM, opt);
}
}

fprintf(stdout,"Spnego : %d\n",spnego);
while (i--) {
Token = (const char *)create_token(spnego,"w2k3.windows2003.home");
fprintf(stdout,"Token: %s\n",Token);
}
return(0);
}

Please try the following patch and let us know if it resolves the
output token buffer leak.

Index: src/lib/gssapi/spnego/spnego_mech.c
===================================================================
--- src/lib/gssapi/spnego/spnego_mech.c (revision 19756)
+++ src/lib/gssapi/spnego/spnego_mech.c (revision 19757)
@@ -835,6 +835,7 @@
ret = GSS_S_FAILURE;
}
}
+ gss_release_buffer(tmpmin, &mechtok_out);
if (ret == GSS_S_COMPLETE) {
/*
* Now, switch the output context to refer to the