From 363902ce2c7c58d3b9ff64cc5bed79b8bf01dff4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= Date: Thu, 8 Apr 2021 10:33:44 +0200 Subject: [PATCH 1/2] Free resources when gss_accept_sec_context() fails Even if a call to gss_accept_sec_context() fails, it might still cause a GSS-API response token to be allocated and left for the caller to release. Make sure the token is released before an early return from dst_gssapi_acceptctx(). (cherry picked from commit d954e152d9f2901118b1fe36d3931ec244317fab) --- lib/dns/gssapictx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c index 47f6dda1ae..b0c62497a5 100644 --- a/lib/dns/gssapictx.c +++ b/lib/dns/gssapictx.c @@ -733,6 +733,9 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab, default: gss_log(3, "failed gss_accept_sec_context: %s", gss_error_tostring(gret, minor, buf, sizeof(buf))); + if (gouttoken.length > 0U) { + (void)gss_release_buffer(&minor, &gouttoken); + } return (result); } From ef4460949f43440cd6656338c2d2a0f77fab5abf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= Date: Thu, 8 Apr 2021 10:33:44 +0200 Subject: [PATCH 2/2] Add CHANGES entry (cherry picked from commit 7eb87270a4362968f41dfc8febea95c1e2003c8c) --- CHANGES | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGES b/CHANGES index d7939eb001..c6fa0c6deb 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +5614. [bug] Ensure all resources are properly cleaned up when a call + to gss_accept_sec_context() fails. [GL #2620] + 5613. [bug] It was possible to write an invalid transaction header in the journal file for a managed-keys database after upgrading. This has been fixed. Invalid headers in