[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: bug with keytab_any?
On Tue, Jun 12, 2001 at 05:56:54PM +0200, Johan Danielsson wrote:
> "Jacques A. Vidrine" <n@nectar.com> writes:
>
> > Basically krb5_storage_free() is being called twice with the same
> > pointer, causing that pointer to be free'd twice.
>
> I can't repeat this. with login or ktutil. There must be some
> interaction with PAM that does it. Can you debug further?
I haven't been able to pin it down exactly. I haven't had a chance to
wrap my head around keytab_any. However, I think the following should
be enough for someone who understands how the code is supposed to
function.
I put a `while (spin);' into krb5_storage_free so I could attach & see
how it was getting called. What I found was that the cursor's sp is
getting freed by both fkt_end_seq_get and krb4_kt_end_seq_get. I
believe the sequence is something like:
krb5_kt_read_service_key
|krb5_kt_get_entry
| krb5_kt_get_entry
| |krb5_kt_next_entry
| | any_next_entry
| | krb5_kt_end_seq_get
| | fkt_end_seq_get
| | krb5_storage_free
| krb5_kt_end_seq_get
| |krb5_kt_end_seq_get
| | any_end_seq_get
| | krb5_kt_end_seq_get
| | krb4_kt_end_seq_get
| | krb5_storage_free
Here are two backtraces, once from each of the first two calls of
krb5_storage_free.
(gdb) bt
#0 0x28156fc8 in krb5_storage_free (sp=0x804e3e0) at store.c:105
#1 0x281523fa in fkt_end_seq_get (context=0x8055000, id=0x80532c0, cursor=0x80525b4) at keytab_file.c:400
#2 0x28151830 in krb5_kt_end_seq_get (context=0x8055000, id=0x80532c0, cursor=0x80525b4) at keytab.c:420
#3 0x28151b5a in any_next_entry (context=0x8055000, id=0x8053280, entry=0xbfbfe788, cursor=0xbfbfe77c)
at keytab_any.c:166
#4 0x281517f1 in krb5_kt_next_entry (context=0x8055000, id=0x8053280, entry=0xbfbfe788, cursor=0xbfbfe77c)
at keytab.c:402
#5 0x28151635 in krb5_kt_get_entry (context=0x8055000, id=0x8053280, principal=0x8052500, kvno=0,
enctype=ETYPE_NULL, entry=0xbfbfe7e8) at keytab.c:286
#6 0x28151457 in krb5_kt_read_service_key (context=0x8055000, keyprocarg=0x0, principal=0x8052500, vno=0,
enctype=ETYPE_NULL, key=0xbfbfe854) at keytab.c:183
#7 0x28147a3b in verify_krb_v5_tgt () from /usr/lib/pam_krb5.so
#8 0x281464fe in pam_sm_authenticate () from /usr/lib/pam_krb5.so
#9 0x2808aa7f in pam_getenvlist () from /usr/lib/libpam.so.1
#10 0x2808ad3e in _pam_dispatch () from /usr/lib/libpam.so.1
#11 0x2808a057 in pam_authenticate () from /usr/lib/libpam.so.1
#12 0x804acda in free ()
#13 0x8049ea1 in free ()
#14 0x8049a09 in free ()
(gdb) bt
#0 0x28156fca in krb5_storage_free (sp=0x804e3e0) at store.c:105
#1 0x281536b2 in krb4_kt_end_seq_get (context=0x8055000, id=0x8053300, c=0x80525b4) at keytab_krb4.c:222
#2 0x28151830 in krb5_kt_end_seq_get (context=0x8055000, id=0x8053300, cursor=0x80525b4) at keytab.c:420
#3 0x28151bdf in any_end_seq_get (context=0x8055000, id=0x8053280, cursor=0xbfbfe77c) at keytab_any.c:193
#4 0x28151830 in krb5_kt_end_seq_get (context=0x8055000, id=0x8053280, cursor=0xbfbfe77c) at keytab.c:420
#5 0x2815164d in krb5_kt_get_entry (context=0x8055000, id=0x8053280, principal=0x8052500, kvno=0,
enctype=ETYPE_NULL, entry=0xbfbfe7e8) at keytab.c:287
#6 0x28151457 in krb5_kt_read_service_key (context=0x8055000, keyprocarg=0x0, principal=0x8052500, vno=0,
enctype=ETYPE_NULL, key=0xbfbfe854) at keytab.c:183
#7 0x28147a3b in verify_krb_v5_tgt () from /usr/lib/pam_krb5.so
#8 0x281464fe in pam_sm_authenticate () from /usr/lib/pam_krb5.so
#9 0x2808aa7f in pam_getenvlist () from /usr/lib/libpam.so.1
#10 0x2808ad3e in _pam_dispatch () from /usr/lib/libpam.so.1
#11 0x2808a057 in pam_authenticate () from /usr/lib/libpam.so.1
#12 0x804acda in free ()
#13 0x8049ea1 in free ()
#14 0x8049a09 in free ()
While looking at this, I found a second, more trivial, free bug. In
keytab_any.c::any_start_seq_get, `ed' and `c->data' are aliases, but
they are both free'd. Fix below.
--- lib/krb5/keytab_any.c.ORIG Fri Jun 15 12:56:37 2001
+++ lib/krb5/keytab_any.c Fri Jun 15 12:57:02 2001
@@ -139,7 +139,6 @@
ed->a = a;
ret = krb5_kt_start_seq_get(context, ed->a->kt, &ed->cursor);
if (ret) {
- free (ed);
free (c->data);
c->data = NULL;
krb5_set_error_string (context, "malloc: out of memory");
Hope this helps,
--
Jacques Vidrine / n@nectar.com / jvidrine@verio.net / nectar@FreeBSD.org