kdc: Fix possible double free of ac pointer

This fixes possible double free of ac pointer. In the function
'krb5_auth_con_free' pointer ac (auth_context) is freed. In case
'ac != NULL', 'ac != tgs_ac', 'ac->remote_subkey == NULL' this
function is called twice (when logging "FAST AP-REQ remote subkey
missing" and at label 'out').

Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru>
This commit is contained in:
Daniil Sarafannikov
2026-06-19 15:45:08 +04:00
committed by Nico Williams
parent afc4c486a1
commit 6386d8ff82
+1
View File
@@ -622,6 +622,7 @@ fast_unwrap_request(astgs_request_t r,
if (ac->remote_subkey == NULL) {
krb5_auth_con_free(r->context, ac);
ac = NULL;
kdc_log(r->context, r->config, 2,
"FAST AP-REQ remote subkey missing");
ret = KRB5KDC_ERR_PREAUTH_FAILED;