From: Andrew Deason <adeason@sinenomine.net>
Date: Fri, 1 Feb 2019 22:31:50 +0000 (-0600)
Subject: Avoid calling krb5_free_context(NULL)
X-Git-Tag: upstream/1.8.6_pre1^2~42
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=64d0352df1406d9601d6d772555c4c39efc05d7e;p=packages%2Fo%2Fopenafs.git

Avoid calling krb5_free_context(NULL)

Several places in the code currently call krb5_free_context(ctx) in a
cleanup code path, where 'ctx' may or may not be NULL. This is not
guaranteed to be okay, so check for NULL to make sure we don't cause
issues in these code paths.

While we are here cleaning up krb5_free_context() calls, also fix a
few call sites in afscp_util.c that were not calling krb5_free_context
in all error paths.

Reviewed-on: https://gerrit.openafs.org/13461
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
(cherry picked from commit 26b1dc036719a588a5cadecb14053bd4079c1f48)

Change-Id: I3b0d22f51f4fe85897116b7f96d096570258eed2
Reviewed-on: https://gerrit.openafs.org/13902
Reviewed-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
---

diff --git a/src/aklog/aklog.c b/src/aklog/aklog.c
index 8d2ac3513..66b4dfe39 100644
--- a/src/aklog/aklog.c
+++ b/src/aklog/aklog.c
@@ -317,9 +317,10 @@ redirect_errors(const char *who, afs_int32 code, const char *fmt, va_list ap)
 	    krb5_svc_get_msg(code,&str);
 #elif defined(HAVE_KRB5_GET_ERROR_MESSAGE)
 	    krb5_context context;
-	    krb5_init_context(&context);
-	    str = krb5_get_error_message(context, code);
-	    krb5_free_context(context);
+	    if (krb5_init_context(&context) == 0) {
+                str = krb5_get_error_message(context, code);
+                krb5_free_context(context);
+            }
 #else
 	    ; /* IRIX apparently has neither: use the string we have */
 #endif
diff --git a/src/libafscp/afscp_util.c b/src/libafscp/afscp_util.c
index 47fcfcd56..0e5a0e28c 100644
--- a/src/libafscp/afscp_util.c
+++ b/src/libafscp/afscp_util.c
@@ -216,7 +216,7 @@ _GetSecurityObject(struct afscp_cell *cell)
 {
     int code = ENOENT;
 #ifdef HAVE_KERBEROS
-    krb5_context context;
+    krb5_context context = NULL;
     krb5_creds match;
     krb5_creds *cred;
     krb5_ccache cc;
@@ -286,7 +286,6 @@ _GetSecurityObject(struct afscp_cell *cell)
 	krb5_free_cred_contents(context, &match);
 	if (cc)
 	    krb5_cc_close(context, cc);
-	krb5_free_context(context);
 	goto try_anon;
     }
 
@@ -303,7 +302,6 @@ _GetSecurityObject(struct afscp_cell *cell)
 	    krb5_free_cred_contents(context, &match);
 	    if (cc)
 		krb5_cc_close(context, cc);
-	    krb5_free_context(context);
 	    goto try_anon;
 	}
     }
@@ -325,7 +323,10 @@ _GetSecurityObject(struct afscp_cell *cell)
     cell->scindex = 2;
     return 0;
 
-    try_anon:
+ try_anon:
+    if (context != NULL) {
+        krb5_free_context(context);
+    }
 #endif /* HAVE_KERBEROS */
     if (try_anonymous)
 	return _GetNullSecurityObject(cell);
diff --git a/src/rxkad/ticket5.c b/src/rxkad/ticket5.c
index 3b4bafe45..cc6777bba 100644
--- a/src/rxkad/ticket5.c
+++ b/src/rxkad/ticket5.c
@@ -624,7 +624,9 @@ cleanup:
     if (cr != NULL)
 	krb5_crypto_destroy(context, cr);
     krb5_free_keyblock_contents(context, &kb);
-    krb5_free_context(context);
+    if (context != NULL) {
+        krb5_free_context(context);
+    }
     rxi_Free(buf, allocsiz);
     if ((code & 0xFFFFFF00) == ERROR_TABLE_BASE_asn1)
 	return RXKADINCONSISTENCY;