gssd: Fix double free when exporting lucid context

[nfs-utils.git] / utils / gssd / context_lucid.c

diff --git a/utils/gssd/context_lucid.c b/utils/gssd/context_lucid.c
index b87bf76219074e32de3dddc7b9f33c6404b2ad62..badbe88d82ec5c8c957aa880758f9ac51381f5ee 100644 (file)
--- a/utils/gssd/context_lucid.c
+++ b/utils/gssd/context_lucid.c
@@ -77,9 +77,10 @@ prepare_krb5_rfc1964_buffer(gss_krb5_lucid_context_v1_t *lctx,
        unsigned char fakeseed[FAKESEED_SIZE];
        uint32_t word_send_seq;
        gss_krb5_lucid_key_t enc_key;
-       int i;
+       uint32_t i;
        char *skd, *dkd;
        gss_buffer_desc fakeoid;
+       int err;
 
        /*
         * The new Kerberos interface to get the gss context
@@ -138,11 +139,10 @@ prepare_krb5_rfc1964_buffer(gss_krb5_lucid_context_v1_t *lctx,
        dkd = (char *) enc_key.data;
        for (i = 0; i < enc_key.length; i++)
                dkd[i] = skd[i] ^ 0xf0;
-       if (write_lucid_keyblock(&p, end, &enc_key)) {
-               free(enc_key.data);
-               goto out_err;
-       }
+       err = write_lucid_keyblock(&p, end, &enc_key);
        free(enc_key.data);
+       if (err)
+               goto out_err;
 
        if (write_lucid_keyblock(&p, end, &lctx->rfc1964_kd.ctx_key))
                goto out_err;
@@ -153,7 +153,6 @@ out_err:
        printerr(0, "ERROR: failed serializing krb5 context for kernel\n");
        if (buf->value) free(buf->value);
        buf->length = 0;
-       if (enc_key.data) free(enc_key.data);
        return -1;
 }
 
@@ -202,6 +201,8 @@ prepare_krb5_rfc4121_buffer(gss_krb5_lucid_context_v1_t *lctx,
 
        if (WRITE_BYTES(&p, end, v2_flags)) goto out_err;
        if (WRITE_BYTES(&p, end, lctx->endtime)) goto out_err;
+       if (endtime)
+               *endtime = lctx->endtime;
        if (WRITE_BYTES(&p, end, lctx->send_seq)) goto out_err;
 
        /* Protocol 0 here implies DES3 or RC4 */
@@ -256,7 +257,7 @@ out_err:
 
 
 int
-serialize_krb5_ctx(gss_ctx_id_t ctx, gss_buffer_desc *buf, int32_t *endtime)
+serialize_krb5_ctx(gss_ctx_id_t *ctx, gss_buffer_desc *buf, int32_t *endtime)
 {
        OM_uint32 maj_stat, min_stat;
        void *return_ctx = 0;
@@ -265,7 +266,7 @@ serialize_krb5_ctx(gss_ctx_id_t ctx, gss_buffer_desc *buf, int32_t *endtime)
        int retcode = 0;
 
        printerr(2, "DEBUG: %s: lucid version!\n", __FUNCTION__);
-       maj_stat = gss_export_lucid_sec_context(&min_stat, &ctx,
+       maj_stat = gss_export_lucid_sec_context(&min_stat, ctx,
                                                1, &return_ctx);
        if (maj_stat != GSS_S_COMPLETE) {
                pgsserr("gss_export_lucid_sec_context",
@@ -303,7 +304,7 @@ serialize_krb5_ctx(gss_ctx_id_t ctx, gss_buffer_desc *buf, int32_t *endtime)
 
        maj_stat = gss_free_lucid_sec_context(&min_stat, ctx, return_ctx);
        if (maj_stat != GSS_S_COMPLETE) {
-               pgsserr("gss_export_lucid_sec_context",
+               pgsserr("gss_free_lucid_sec_context",
                        maj_stat, min_stat, &krb5oid);
                printerr(0, "WARN: failed to free lucid sec context\n");
        }