From 4de8b3564e4244c0579abb73cbd40e35c3176dcd Mon Sep 17 00:00:00 2001
From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Tue, 4 Jul 2023 12:43:43 +1200
Subject: [PATCH] kdc: Fix leak with PK-INIT-Win2k

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
---
 kdc/pkinit.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index b718205a4..fd0b20fc0 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -681,6 +681,7 @@ _kdc_pk_rd_padata(astgs_request_t priv,
 	    ret = KRB5KRB_ERR_GENERIC;
 	    krb5_set_error_message(context, ret,
 				   "DH not supported for Win2k");
+	    free_AuthPack_Win2k(&ap);
 	    goto out;
 	}
 	free_AuthPack_Win2k(&ap);