|
 |
c41359 |
From 390c515e13dffc8c00b44623cba47e27c2f20cf7 Mon Sep 17 00:00:00 2001
|
|
|
c41359 |
From: Greg Hudson <ghudson@mit.edu>
|
|
|
c41359 |
Date: Tue, 27 Mar 2018 10:36:05 -0400
|
|
|
c41359 |
Subject: [PATCH] Fix SPAKE memory leak
|
|
|
c41359 |
|
|
|
c41359 |
In the NIST group implementations, ossl_fini() needs to free the
|
|
|
c41359 |
groupdata container as well as its fields. Also in
|
|
|
c41359 |
spake_kdc.c:parse_data(), initialize the magic field of the resulting
|
|
|
c41359 |
data object to avoid a harmless uninitialized memory copy.
|
|
|
c41359 |
|
|
|
c41359 |
ticket: 8647
|
|
|
c41359 |
(cherry picked from commit 70b88b8018658e052d6eabf06f8fdad17fbe993c)
|
|
|
c41359 |
---
|
|
|
c41359 |
src/plugins/preauth/spake/openssl.c | 1 +
|
|
|
c41359 |
src/plugins/preauth/spake/spake_kdc.c | 1 +
|
|
|
c41359 |
2 files changed, 2 insertions(+)
|
|
|
c41359 |
|
|
|
c41359 |
diff --git a/src/plugins/preauth/spake/openssl.c b/src/plugins/preauth/spake/openssl.c
|
|
|
c41359 |
index b821a9158..f2e4b53ec 100644
|
|
|
c41359 |
--- a/src/plugins/preauth/spake/openssl.c
|
|
|
c41359 |
+++ b/src/plugins/preauth/spake/openssl.c
|
|
|
c41359 |
@@ -69,6 +69,7 @@ ossl_fini(groupdata *gd)
|
|
|
c41359 |
EC_POINT_free(gd->N);
|
|
|
c41359 |
BN_CTX_free(gd->ctx);
|
|
|
c41359 |
BN_free(gd->order);
|
|
|
c41359 |
+ free(gd);
|
|
|
c41359 |
}
|
|
|
c41359 |
|
|
|
c41359 |
static krb5_error_code
|
|
|
c41359 |
diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c
|
|
|
c41359 |
index c1723ebaf..59e88409e 100644
|
|
|
c41359 |
--- a/src/plugins/preauth/spake/spake_kdc.c
|
|
|
c41359 |
+++ b/src/plugins/preauth/spake/spake_kdc.c
|
|
|
c41359 |
@@ -75,6 +75,7 @@ parse_data(struct k5input *in, krb5_data *out)
|
|
|
c41359 |
{
|
|
|
c41359 |
out->length = k5_input_get_uint32_be(in);
|
|
|
c41359 |
out->data = (char *)k5_input_get_bytes(in, out->length);
|
|
|
c41359 |
+ out->magic = KV5M_DATA;
|
|
|
c41359 |
}
|
|
|
c41359 |
|
|
|
c41359 |
/* Parse a received cookie into its components. The pointers stored in the
|