From 3604497fda998f45026fad88967bebc647f03e1e Mon Sep 17 00:00:00 2001
From: Luke Howard <lukeh@padl.com>
Date: Wed, 4 Aug 2021 17:41:01 +1000
Subject: [PATCH] kdc: zero KDCFastState padata before free

---
 kdc/fast.c      | 15 +++++++++++++++
 kdc/kerberos5.c |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/kdc/fast.c b/kdc/fast.c
index d9d6d5f09..238ac8dd5 100644
--- a/kdc/fast.c
+++ b/kdc/fast.c
@@ -560,3 +560,18 @@ _kdc_fast_unwrap_request(astgs_request_t r)
 
     return ret;
 }
+
+void
+_kdc_free_fast_state(KDCFastState *state)
+{
+    size_t i;
+
+    for (i = 0; i < state->fast_state.len; i++) {
+	PA_DATA *pa = &state->fast_state.val[i];
+
+	if (pa->padata_value.data)
+	    memset_s(pa->padata_value.data, 0,
+		     pa->padata_value.length, pa->padata_value.length);
+    }
+    free_KDCFastState(state);
+}
diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 1c887d666..9d5800df6 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -2505,7 +2505,7 @@ out:
 
     free_EncTicketPart(&r->et);
     free_EncKDCRepPart(&r->ek);
-    free_KDCFastState(&r->fast);
+    _kdc_free_fast_state(&r->fast);
 
     if (error_method.len)
 	free_METHOD_DATA(&error_method);