From 6386d8ff82e67aa3084981d2eacb42e4b1e2e5b6 Mon Sep 17 00:00:00 2001 From: Daniil Sarafannikov Date: Fri, 19 Jun 2026 15:45:08 +0400 Subject: [PATCH] kdc: Fix possible double free of ac pointer This fixes possible double free of ac pointer. In the function 'krb5_auth_con_free' pointer ac (auth_context) is freed. In case 'ac != NULL', 'ac != tgs_ac', 'ac->remote_subkey == NULL' this function is called twice (when logging "FAST AP-REQ remote subkey missing" and at label 'out'). Pair-Programmed-With: Dmitry Mikhalchenko Signed-off-by: Daniil Sarafannikov --- kdc/fast.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kdc/fast.c b/kdc/fast.c index eaeb9a543..4eab9e31e 100644 --- a/kdc/fast.c +++ b/kdc/fast.c @@ -622,6 +622,7 @@ fast_unwrap_request(astgs_request_t r, if (ac->remote_subkey == NULL) { krb5_auth_con_free(r->context, ac); + ac = NULL; kdc_log(r->context, r->config, 2, "FAST AP-REQ remote subkey missing"); ret = KRB5KDC_ERR_PREAUTH_FAILED;