negoex: Fix use-after-free

2023-01-02 20:38:24 -06:00
parent df81ad1c93
commit 7c519d9c34
1 changed files with 6 additions and 1 deletions
--- a/lib/gssapi/spnego/negoex_util.c
+++ b/lib/gssapi/spnego/negoex_util.c
@@ -87,10 +87,15 @@ static void
 release_all_mechs(gssspnego_ctx ctx, krb5_context context)
 {
    struct negoex_auth_mech *mech, *next;
+    struct negoex_auth_mech *prev = NULL;

    HEIM_TAILQ_FOREACH_SAFE(mech, &ctx->negoex_mechs, links, next) {
-	_gss_negoex_release_auth_mech(context, mech);
+	if (prev)
+	    _gss_negoex_release_auth_mech(context, prev);
+	prev = mech;
    }
+    if (prev)
+	_gss_negoex_release_auth_mech(context, mech);

    HEIM_TAILQ_INIT(&ctx->negoex_mechs);
 }