From 877df213ebee83a358a21adfa18404e9d325c196 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Love=20H=C3=B6rnquist=20=C3=85strand?= <lha@h5l.org>
Date: Mon, 31 Oct 2011 22:05:42 -0700
Subject: [PATCH] make sure we don't use stack content, don't count on that
 unsigned value can be negative

---
 lib/krb5/principal.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/krb5/principal.c b/lib/krb5/principal.c
index 6c3fa39b1..e84c0f7e3 100644
--- a/lib/krb5/principal.c
+++ b/lib/krb5/principal.c
@@ -1400,8 +1400,8 @@ expand_search_list(krb5_context context, krb5_name_canon_rule *r, size_t *n,
 	return krb5_enomem(context);
     for (i = 0; i < srch_list_len; i++) {
 	if ((domains[i] = strdup(dnsrch[i])) == NULL) {
-	    for (i--; i >= 0; i--)
-		free(domains[i]);
+	    while (i > 0)
+		free(domains[--i]);
 	    return krb5_enomem(context);
 	}
     }
@@ -1896,6 +1896,9 @@ krb5_name_canon_iterate(krb5_context context,
     krb5_error_code ret;
     krb5_name_canon_iterator state = *iter;
 
+    if (rule_opts)
+	*rule_opts = 0;
+
     if (!state)
 	return 0;
     if (state->done) {