From f99145ad788803d9ddf52530c11d4d4a2527d120 Mon Sep 17 00:00:00 2001
From: Nicolas Williams <nico@twosigma.com>
Date: Wed, 4 Jan 2023 16:20:32 -0600
Subject: [PATCH] gsskrb5: Add missing unlock in _gsskrb5_duplicate_cred()
 failure case

---
 lib/gssapi/krb5/duplicate_cred.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/gssapi/krb5/duplicate_cred.c b/lib/gssapi/krb5/duplicate_cred.c
index f5b34c514..a44ec3b23 100644
--- a/lib/gssapi/krb5/duplicate_cred.c
+++ b/lib/gssapi/krb5/duplicate_cred.c
@@ -76,12 +76,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_duplicate_cred (
     HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
 
     dup->destination_realm = NULL;
-    if (cred->destination_realm &&
-        (dup->destination_realm = strdup(cred->destination_realm)) == NULL) {
-        *minor_status = krb5_enomem(context);
-        free(dup);
-        return (GSS_S_FAILURE);
-    }
     dup->usage = cred->usage;
     dup->endtime = cred->endtime;
     dup->principal = NULL;
@@ -92,6 +86,11 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_duplicate_cred (
     major = GSS_S_FAILURE;
 
     HEIMDAL_MUTEX_init(&dup->cred_id_mutex);
+    if (cred->destination_realm &&
+        (dup->destination_realm = strdup(cred->destination_realm)) == NULL) {
+        *minor_status = krb5_enomem(context);
+        goto fail;
+    }
     *minor_status = krb5_copy_principal(context, cred->principal,
                                         &dup->principal);
     if (*minor_status)