svn commit: r298655 - head/sys/kgssapi

[Alan Somers]

Nice catch.  Will you be MFCing this to stable/10?

On Tue, Apr 26, 2016 at 12:11 PM, Conrad E. Meyer <cem at freebsd.org> wrote:

> Author: cem
> Date: Tue Apr 26 18:11:45 2016
> New Revision: 298655
> URL: https://svnweb.freebsd.org/changeset/base/298655
>
> Log:
>   kgssapi: Don't leak memory in error cases
>
>   Reported by:  Coverity
>   CIDs:         1007046, 1007047, 1007048
>   Sponsored by: EMC / Isilon Storage Division
>
> Modified:
>   head/sys/kgssapi/gssd_prot.c
>
> Modified: head/sys/kgssapi/gssd_prot.c
>
> ==============================================================================
> --- head/sys/kgssapi/gssd_prot.c        Tue Apr 26 18:08:51 2016
> (r298654)
> +++ head/sys/kgssapi/gssd_prot.c        Tue Apr 26 18:11:45 2016
> (r298655)
> @@ -101,8 +101,10 @@ xdr_gss_OID(XDR *xdrs, gss_OID *oidp)
>                 } else {
>                         oid = mem_alloc(sizeof(gss_OID_desc));
>                         memset(oid, 0, sizeof(*oid));
> -                       if (!xdr_gss_OID_desc(xdrs, oid))
> +                       if (!xdr_gss_OID_desc(xdrs, oid)) {
> +                               mem_free(oid, sizeof(gss_OID_desc));
>                                 return (FALSE);
> +                       }
>                         *oidp = oid;
>                 }
>                 break;
> @@ -164,8 +166,10 @@ xdr_gss_OID_set(XDR *xdrs, gss_OID_set *
>                 } else {
>                         set = mem_alloc(sizeof(gss_OID_set_desc));
>                         memset(set, 0, sizeof(*set));
> -                       if (!xdr_gss_OID_set_desc(xdrs, set))
> +                       if (!xdr_gss_OID_set_desc(xdrs, set)) {
> +                               mem_free(set, sizeof(gss_OID_set_desc));
>                                 return (FALSE);
> +                       }
>                         *setp = set;
>                 }
>                 break;
> @@ -224,8 +228,10 @@ xdr_gss_channel_bindings_t(XDR *xdrs, gs
>                             || !xdr_gss_buffer_desc(xdrs,
>                                 &ch->acceptor_address)
>                             || !xdr_gss_buffer_desc(xdrs,
> -                               &ch->application_data))
> +                               &ch->application_data)) {
> +                               mem_free(ch, sizeof(*ch));
>                                 return (FALSE);
> +                       }
>                         *chp = ch;
>                 }
>                 break;
>
>