From af371af07a01b5ad276c0849c69c23cf87722e3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Love=20H=C3=B6rnquist=20=C3=85strand?= <lha@kth.se>
Date: Sun, 31 Aug 2003 02:05:31 +0000
Subject: [PATCH] (krb5_copy_ticket): free all data when failing, copy data to
 right memory, the later pointed out by Luke Howard.

git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@12709 ec53bebd-3082-4978-b11e-865c3cabbd6b
---
 lib/krb5/ticket.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/krb5/ticket.c b/lib/krb5/ticket.c
index f0b0a0c0d..ae83c2229 100644
--- a/lib/krb5/ticket.c
+++ b/lib/krb5/ticket.c
@@ -51,7 +51,10 @@ krb5_copy_ticket(krb5_context context,
 		 krb5_ticket **to)
 {
     krb5_error_code ret;
-    krb5_ticket *tmp = malloc(sizeof(*tmp));
+    krb5_ticket *tmp;
+
+    *to = NULL;
+    tmp = malloc(sizef(*tmp));
     if(tmp == NULL) {
 	krb5_set_error_string (context, "malloc: out of memory");
 	return ENOMEM;
@@ -63,12 +66,14 @@ krb5_copy_ticket(krb5_context context,
     ret = krb5_copy_principal(context, from->client, &tmp->client);
     if(ret){
 	free_EncTicketPart(&tmp->ticket);
+	free(tmp);
 	return ret;
     }
-    ret = krb5_copy_principal(context, from->server, &(*to)->server);
+    ret = krb5_copy_principal(context, from->server, &tmp->server);
     if(ret){
 	krb5_free_principal(context, tmp->client);
 	free_EncTicketPart(&tmp->ticket);
+	free(tmp);
 	return ret;
     }
     *to = tmp;