| From: | ghudson@mit.edu |
| Subject: | git commit |
Fix unlikely double free in PKINIT client code
In pa_pkinit_gen_req, if the cleanup handler is reached with non-zero
retval and non-null out_data, out_data is freed, then dereferenced,
then freed again. This can only happen if one of the small fixed-size
malloc requests fails after pkinit_as_req_create succeeds, so it is
unlikely to occur in practice.
https://github.com/krb5/krb5/commit/cc002d6c1ccfc08356d01ba83e72a46855d0302c
Author: Greg Hudson <ghudson@mit.edu>
Commit: cc002d6c1ccfc08356d01ba83e72a46855d0302c
Branch: master
src/plugins/preauth/pkinit/pkinit_clnt.c | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)