Ticket History #8223: Uncommon memory leak of err_padata in krb5_init_creds_step()

The krb5_init_creds_context err_padata field is used internally to a
krb5_init_creds_step() operation. It is populated in
init_creds_step_reply() with a call to krb5int_fast_process_error().
It is released or transferred in some error-handling paths, and is
released when the context is destroyed. If it survives at the end of
a call and another KRB-ERROR message is processed in a subsequent
step operation, it is leaked. This can happen in two cases:

* When a realm referral is received, ctx->err_reply is freed but ctx-
padata, but if they do, and a KRB-ERROR is received on the next query
in the new realm, the padata will be leaked.

* If the error padata is used for k5_preauth_tryagain(), ctx-
k5_preauth_tryagain() succeeds in producing another request and
another KRB-ERROR is received, the padata will be leaked.

Fix uncommon leak in krb5_init_creds_step()

Release any previous value of ctx->err_padata before setting it in
init_creds_step_reply(). It could have a prior value after a realm
referral or retriable error.

(cherry picked from commit 997eb174f5fd81747ad0ecb671f00c25951931b1)

https://github.com/krb5/krb5/commit/6ee030430abcfd76294b6599ccaa24c4d36674db
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: 6ee030430abcfd76294b6599ccaa24c4d36674db
Branch: krb5-1.13
src/lib/krb5/krb/get_in_tkt.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)