svn commit: r298655 - head/sys/kgssapi

[Conrad Meyer]

Nope!  I don't do stable/.

On Tue, Apr 26, 2016 at 12:06 PM, Alan Somers <asomers at freebsd.org> wrote:

> Nice catch.  Will you be MFCing this to stable/10?
>
> On Tue, Apr 26, 2016 at 12:11 PM, Conrad E. Meyer <cem at freebsd.org> wrote:
>
>> Author: cem
>> Date: Tue Apr 26 18:11:45 2016
>> New Revision: 298655
>> URL: https://svnweb.freebsd.org/changeset/base/298655
>>
>> Log:
>>   kgssapi: Don't leak memory in error cases
>>
>>   Reported by:  Coverity
>>   CIDs:         1007046, 1007047, 1007048
>>   Sponsored by: EMC / Isilon Storage Division
>>
>> Modified:
>>   head/sys/kgssapi/gssd_prot.c
>>
>> Modified: head/sys/kgssapi/gssd_prot.c
>>
>> ==============================================================================
>> --- head/sys/kgssapi/gssd_prot.c        Tue Apr 26 18:08:51 2016
>> (r298654)
>> +++ head/sys/kgssapi/gssd_prot.c        Tue Apr 26 18:11:45 2016
>> (r298655)
>> @@ -101,8 +101,10 @@ xdr_gss_OID(XDR *xdrs, gss_OID *oidp)
>>                 } else {
>>                         oid = mem_alloc(sizeof(gss_OID_desc));
>>                         memset(oid, 0, sizeof(*oid));
>> -                       if (!xdr_gss_OID_desc(xdrs, oid))
>> +                       if (!xdr_gss_OID_desc(xdrs, oid)) {
>> +                               mem_free(oid, sizeof(gss_OID_desc));
>>                                 return (FALSE);
>> +                       }
>>                         *oidp = oid;
>>                 }
>>                 break;
>> @@ -164,8 +166,10 @@ xdr_gss_OID_set(XDR *xdrs, gss_OID_set *
>>                 } else {
>>                         set = mem_alloc(sizeof(gss_OID_set_desc));
>>                         memset(set, 0, sizeof(*set));
>> -                       if (!xdr_gss_OID_set_desc(xdrs, set))
>> +                       if (!xdr_gss_OID_set_desc(xdrs, set)) {
>> +                               mem_free(set, sizeof(gss_OID_set_desc));
>>                                 return (FALSE);
>> +                       }
>>                         *setp = set;
>>                 }
>>                 break;
>> @@ -224,8 +228,10 @@ xdr_gss_channel_bindings_t(XDR *xdrs, gs
>>                             || !xdr_gss_buffer_desc(xdrs,
>>                                 &ch->acceptor_address)
>>                             || !xdr_gss_buffer_desc(xdrs,
>> -                               &ch->application_data))
>> +                               &ch->application_data)) {
>> +                               mem_free(ch, sizeof(*ch));
>>                                 return (FALSE);
>> +                       }
>>                         *chp = ch;
>>                 }
>>                 break;
>>
>>
>