|
 |
905476 |
From ff9c99b689855a646c371379d30a668dfd7a87a7 Mon Sep 17 00:00:00 2001
|
|
|
905476 |
From: Julien Rische <jrische@redhat.com>
|
|
|
905476 |
Date: Wed, 1 Feb 2023 15:57:26 +0100
|
|
|
905476 |
Subject: [PATCH] Fix possible double-free during KDB creation
|
|
|
905476 |
|
|
|
905476 |
In krb5_dbe_def_encrypt_key_data(), when we free
|
|
|
905476 |
key_data->key_data_contents[0], reset it to null so the caller doesn't
|
|
|
905476 |
free it as well.
|
|
|
905476 |
|
|
|
905476 |
Since commit a06945b4ec267e8b80e5e8c95edd89930ff12103 this bug
|
|
|
905476 |
manifests as a double-free during KDB creation if master key
|
|
|
905476 |
encryption fails.
|
|
|
905476 |
|
|
|
905476 |
[ghudson@mit.edu: edited commit message]
|
|
|
905476 |
|
|
|
905476 |
ticket: 9086 (new)
|
|
|
905476 |
tags: pullup
|
|
|
905476 |
target_version: 1.20-next
|
|
|
905476 |
---
|
|
|
905476 |
src/lib/kdb/encrypt_key.c | 2 ++
|
|
|
905476 |
1 file changed, 2 insertions(+)
|
|
|
905476 |
|
|
|
905476 |
diff --git a/src/lib/kdb/encrypt_key.c b/src/lib/kdb/encrypt_key.c
|
|
|
905476 |
index dc612c810e..91debea533 100644
|
|
|
905476 |
--- a/src/lib/kdb/encrypt_key.c
|
|
|
905476 |
+++ b/src/lib/kdb/encrypt_key.c
|
|
|
905476 |
@@ -109,6 +109,7 @@ krb5_dbe_def_encrypt_key_data( krb5_context context,
|
|
|
905476 |
if ((retval = krb5_c_encrypt(context, mkey, /* XXX */ 0, 0,
|
|
|
905476 |
&plain, &cipher))) {
|
|
|
905476 |
free(key_data->key_data_contents[0]);
|
|
|
905476 |
+ key_data->key_data_contents[0] = NULL;
|
|
|
905476 |
return retval;
|
|
|
905476 |
}
|
|
|
905476 |
|
|
|
905476 |
@@ -121,6 +122,7 @@ krb5_dbe_def_encrypt_key_data( krb5_context context,
|
|
|
905476 |
key_data->key_data_contents[1] = malloc(keysalt->data.length);
|
|
|
905476 |
if (key_data->key_data_contents[1] == NULL) {
|
|
|
905476 |
free(key_data->key_data_contents[0]);
|
|
|
905476 |
+ key_data->key_data_contents[0] = NULL;
|
|
|
905476 |
return ENOMEM;
|
|
|
905476 |
}
|
|
|
905476 |
memcpy(key_data->key_data_contents[1], keysalt->data.data,
|
|
|
905476 |
--
|
|
|
905476 |
2.39.1
|
|
|
905476 |
|