s4-auth: fixed crash in krb5 auth
authorAndrew Tridgell <tridge@samba.org>
Sun, 14 Nov 2010 02:40:02 +0000 (13:40 +1100)
committerAndrew Tridgell <tridge@samba.org>
Sun, 14 Nov 2010 02:53:29 +0000 (13:53 +1100)
remote_addr was used after free

source4/auth/kerberos/krb5_init_context.c

index 6727de0f997df8c4e2f8cd5e110d0d8b2fa072d1..ebe19e6b2580c0d439cb84dc39dbce4e2b6050dc 100644 (file)
@@ -207,7 +207,6 @@ krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
 {
        krb5_error_code ret;
        NTSTATUS status;
-       struct socket_address *remote_addr;
        const char *name;
        struct addrinfo *ai, *a;
        struct smb_krb5_socket *smb_krb5;
@@ -240,6 +239,7 @@ krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
        }
 
        for (a = ai; a; a = ai->ai_next) {
+               struct socket_address *remote_addr;
                smb_krb5 = talloc(tmp_ctx, struct smb_krb5_socket);
                if (!smb_krb5) {
                        talloc_free(tmp_ctx);
@@ -291,7 +291,6 @@ krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
                        talloc_free(smb_krb5);
                        continue;
                }
-               talloc_free(remote_addr);
 
                /* Setup the FDE, start listening for read events
                 * from the start (otherwise we may miss a socket