From ac1c2d05bc23419b9173d04a7c85a961f5d77445 Mon Sep 17 00:00:00 2001 From: Linar Galimov Date: Tue, 23 Jun 2026 02:22:40 +0400 Subject: [PATCH] krb5: Fix a double free when running into ENOMEM In cred_delete(), sp is freed after returning from krb5_storage_to_data(). Between this point and the subsequent assignment to sp via krb_storage_emem() there are two jumps to out, both are executed in an ENOMEM scenario: malloc fail for cred_data_in_file and krb5_principal_set_realm() fail. In out, sp is freed again. This patch fixes the issue by freeing sp right before the krb5_storage_emem() call. Signed-off-by: Linar Galimov Signed-off-by: Dmitry Mikhalchenko --- lib/krb5/fcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/krb5/fcache.c b/lib/krb5/fcache.c index 1bed403f8..8aeb6f5fb 100644 --- a/lib/krb5/fcache.c +++ b/lib/krb5/fcache.c @@ -1081,7 +1081,6 @@ cred_delete(krb5_context context, ret = krb5_storage_to_data(sp, &orig_cred_data); if (ret) goto out; - krb5_storage_free(sp); cred_data_in_file = malloc(orig_cred_data.length); if (cred_data_in_file == NULL) @@ -1103,6 +1102,7 @@ cred_delete(krb5_context context, goto out; } + krb5_storage_free(sp); sp = krb5_storage_emem(); if (sp == NULL) goto out;