From 4d5c5c67370791abf21a1ac094c640e6abe817f6 Mon Sep 17 00:00:00 2001
From: Nicolas Williams <nico@twosigma.com>
Date: Mon, 17 Jan 2022 10:47:41 -0600
Subject: [PATCH] kdc: Add missing encryption retval check

---
 kdc/kerberos5.c | 40 ++++++++++++++++++++++------------------
 1 file changed, 22 insertions(+), 18 deletions(-)

diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index e87477bc1..85567a880 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -1196,25 +1196,29 @@ _kdc_encode_reply(krb5_context context,
 	return ret;
     }
     if(rep->msg_type == krb_as_rep) {
-	krb5_encrypt_EncryptedData(context,
-				   crypto,
-				   KRB5_KU_AS_REP_ENC_PART,
-				   buf,
-				   len,
-				   ckvno,
-				   &rep->enc_part);
-	free(buf);
-	ASN1_MALLOC_ENCODE(AS_REP, buf, buf_size, rep, &len, ret);
+        ret = krb5_encrypt_EncryptedData(context,
+                                         crypto,
+                                         KRB5_KU_AS_REP_ENC_PART,
+                                         buf,
+                                         len,
+                                         ckvno,
+                                         &rep->enc_part);
+        free(buf);
+        if (ret == 0)
+            ASN1_MALLOC_ENCODE(AS_REP, buf, buf_size, rep, &len, ret);
     } else {
-	krb5_encrypt_EncryptedData(context,
-				   crypto,
-				   rk_is_subkey ? KRB5_KU_TGS_REP_ENC_PART_SUB_KEY : KRB5_KU_TGS_REP_ENC_PART_SESSION,
-				   buf,
-				   len,
-				   ckvno,
-				   &rep->enc_part);
-	free(buf);
-	ASN1_MALLOC_ENCODE(TGS_REP, buf, buf_size, rep, &len, ret);
+        ret = krb5_encrypt_EncryptedData(context,
+                                         crypto,
+                                         rk_is_subkey ?
+                                             KRB5_KU_TGS_REP_ENC_PART_SUB_KEY :
+                                             KRB5_KU_TGS_REP_ENC_PART_SESSION,
+                                         buf,
+                                         len,
+                                         ckvno,
+                                         &rep->enc_part);
+        free(buf);
+        if (ret == 0)
+            ASN1_MALLOC_ENCODE(TGS_REP, buf, buf_size, rep, &len, ret);
     }
     krb5_crypto_destroy(context, crypto);
     if(ret) {