diff options
| -rw-r--r-- | ChangeLog | 3 | ||||
| -rw-r--r-- | sshconnect2.c | 20 |
2 files changed, 13 insertions, 10 deletions
@@ -72,6 +72,7 @@ over usage of PAM. This allows non-root use of sshd when built with --with-pam - (djm) Die screaming if start_pam() is called when UsePAM=no + - (djm) Avoid KrbV leak for MIT Kerberos 20030512 - (djm) Redhat spec: Don't install profile.d scripts when not @@ -1459,4 +1460,4 @@ save auth method before monitor_reset_key_state(); bugzilla bug #284; ok provos@ -$Id: ChangeLog,v 1.2695 2003/05/14 05:31:12 djm Exp $ +$Id: ChangeLog,v 1.2696 2003/05/14 09:23:56 djm Exp $ diff --git a/sshconnect2.c b/sshconnect2.c index f91f5b27..36d592b4 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -1130,12 +1130,10 @@ userauth_hostbased(Authctxt *authctxt) #if KRB5 static int -ssh_krb5_helper(krb5_data *ap) +ssh_krb5_helper(krb5_data *ap, krb5_context *context) { krb5_context xcontext = NULL; /* XXX share with ssh1 */ krb5_auth_context xauth_context = NULL; - - krb5_context *context; krb5_auth_context *auth_context; krb5_error_code problem; const char *tkfile; @@ -1191,8 +1189,6 @@ ssh_krb5_helper(krb5_data *ap) krb5_cc_close(*context, ccache); if (*auth_context) krb5_auth_con_free(*context, *auth_context); - if (*context) - krb5_free_context(*context); return (ret); } @@ -1200,9 +1196,11 @@ int userauth_kerberos(Authctxt *authctxt) { krb5_data ap; + krb5_context *context; + int ret = 0; - if (ssh_krb5_helper(&ap) == 0) - return (0); + if (ssh_krb5_helper(&ap, context) == 0) + goto out; packet_start(SSH2_MSG_USERAUTH_REQUEST); packet_put_cstring(authctxt->server_user); @@ -1214,10 +1212,14 @@ userauth_kerberos(Authctxt *authctxt) #ifdef HEIMDAL krb5_data_free(&ap); #else -# warning "XXX - leaks ap data on MIT kerberos" + krb5_free_data_contents(*context, &ap); #endif + ret = 1; - return (1); +out: + if (*context) + krb5_free_context(*context); + return ret; } #endif |