Ticket History #9016: Memory leak in krb5_gss_inquire_cred

This bug was introduced in commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 ("Make gss-krb5 use cache collection").  In the previous code, cred could be an owner pointer or a casted alias to cred_handle, and the default cred was freed with "if (cred_handle == NULL) krb5_gss_release_cred(minor_status, &cred)" along the success and failure paths.  The aforementioned commit cleans this up by introducing defcred as the owner pointer for the obtained default credential; however, it neglected to update the freeing code along the success path.  Since the new code also reassigns cred_handle when obtaining a default cred, the old code does not trigger and the default credential is not freed.

It looks like it should be possible to unify the success and failure paths, and I may do that rather than make the trivial fix.
 

Fix defcred leak in krb5 gss_inquire_cred()

Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 altered the memory
management of krb5_gss_inquire_cred(), introducing defcred to act as
an owner pointer when the function must acquire a default credential.
The commit neglected to update the code to release the default cred
along the successful path. The old code does not trigger because
cred_handle is now reassigned, so the default credential is leaked.

Unify the success and failure cleanup for this function so that
defcred is properly released on success.

Reported by Pavel Březina.

https://github.com/krb5/krb5/commit/593e16448e1af23eef74689afe06a7bcc86e79c7
Author: Greg Hudson <ghudson@mit.edu>
Commit: 593e16448e1af23eef74689afe06a7bcc86e79c7
Branch: master
src/lib/gssapi/krb5/inq_cred.c | 16 ++++++----------
1 files changed, 6 insertions(+), 10 deletions(-)

Fix defcred leak in krb5 gss_inquire_cred()

Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 altered the memory
management of krb5_gss_inquire_cred(), introducing defcred to act as
an owner pointer when the function must acquire a default credential.
The commit neglected to update the code to release the default cred
along the successful path. The old code does not trigger because
cred_handle is now reassigned, so the default credential is leaked.

Reported by Pavel Březina.

(a minimal alternative to commit 593e16448e1af23eef74689afe06a7bcc86e79c7)

https://github.com/krb5/krb5/commit/b92be484630b38e26f5ee4bd67973fbd7627009c
Author: Greg Hudson <ghudson@mit.edu>
Commit: b92be484630b38e26f5ee4bd67973fbd7627009c
Branch: krb5-1.18
src/lib/gssapi/krb5/inq_cred.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)

Fix defcred leak in krb5 gss_inquire_cred()

Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 altered the memory
management of krb5_gss_inquire_cred(), introducing defcred to act as
an owner pointer when the function must acquire a default credential.
The commit neglected to update the code to release the default cred
along the successful path. The old code does not trigger because
cred_handle is now reassigned, so the default credential is leaked.

Reported by Pavel Březina.

(a minimal alternative to commit 593e16448e1af23eef74689afe06a7bcc86e79c7)

https://github.com/krb5/krb5/commit/098f874f3b50dd2c46c0a574677324b5f6f3a1a8
Author: Greg Hudson <ghudson@mit.edu>
Commit: 098f874f3b50dd2c46c0a574677324b5f6f3a1a8
Branch: krb5-1.19
src/lib/gssapi/krb5/inq_cred.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)