From 21c6ccc982b54e13b8058f9af130ce64426bd4bb Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Wed, 10 Apr 2024 10:15:55 -0400 Subject: [PATCH] Fix some resource leaks identified by a static analyzer Fixes: https://pagure.io/freeipa/issue/9367 Signed-off-by: Rob Crittenden Reviewed-By: Alexander Bokovoy Reviewed-By: Francisco Trivino --- client/ipa-getkeytab.c | 1 + client/ipa-rmkeytab.c | 8 +++++++- daemons/ipa-kdb/ipa_kdb_principals.c | 1 + daemons/ipa-otpd/bind.c | 6 ++++++ daemons/ipa-otpd/forward.c | 20 +++++++++++++------- util/ipa_krb5.c | 1 + 6 files changed, 29 insertions(+), 8 deletions(-) diff --git a/client/ipa-getkeytab.c b/client/ipa-getkeytab.c index cda5b12a9..228b981c2 100644 --- a/client/ipa-getkeytab.c +++ b/client/ipa-getkeytab.c @@ -266,6 +266,7 @@ static int ldap_sasl_interact(LDAP *ld, unsigned flags, void *priv_data, void *s error_message(krberr), krberr); in->result = NULL; in->len = 0; + krb5_free_context(krbctx); ret = LDAP_LOCAL_ERROR; break; } diff --git a/client/ipa-rmkeytab.c b/client/ipa-rmkeytab.c index caa0352bb..78032418a 100644 --- a/client/ipa-rmkeytab.c +++ b/client/ipa-rmkeytab.c @@ -29,6 +29,11 @@ #include "ipa-client-common.h" #include "config.h" +int remove_principal(krb5_context context, krb5_keytab ktid, + const char *principal, int debug); +int remove_realm(krb5_context context, krb5_keytab ktid, + const char *realm, int debug); + #define KERBEROS_ERROR 1 #define OOM_ERROR 2 #define KEYTAB_ERROR 3 @@ -171,7 +176,8 @@ remove_realm(krb5_context context, krb5_keytab ktid, const char *realm, int debu } done: - + krb5_kt_end_seq_get(context, ktid, &kt_cursor); + krb5_free_unparsed_name(context, entry_princ_s); return rval; } diff --git a/daemons/ipa-kdb/ipa_kdb_principals.c b/daemons/ipa-kdb/ipa_kdb_principals.c index 6a2684986..14603e528 100644 --- a/daemons/ipa-kdb/ipa_kdb_principals.c +++ b/daemons/ipa-kdb/ipa_kdb_principals.c @@ -2066,6 +2066,7 @@ void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry) for (i = 0; (acl_list != NULL) && (acl_list[i] != NULL); i++) { free(acl_list[i]); } + free(acl_list); } free(prev->tl_data_contents); free(prev); diff --git a/daemons/ipa-otpd/bind.c b/daemons/ipa-otpd/bind.c index 61efe4d5e..a6fde073a 100644 --- a/daemons/ipa-otpd/bind.c +++ b/daemons/ipa-otpd/bind.c @@ -79,6 +79,7 @@ static void on_bind_readable(verto_ctx *vctx, verto_ev *ev) struct otpd_queue_item *item = NULL; int i, rslt; (void)vctx; + int kerr = 0; rslt = ldap_result(verto_get_private(ev), LDAP_RES_ANY, 0, NULL, &results); if (rslt != LDAP_RES_BIND) { @@ -118,6 +119,7 @@ static void on_bind_readable(verto_ctx *vctx, verto_ev *ev) krad_code_name2num("Access-Accept"), NULL, item->req, &item->rsp); if (i != 0) { + kerr = 1; errstr = krb5_get_error_message(ctx.kctx, i); goto error; } @@ -127,6 +129,10 @@ error: otpd_log_req(item->req, "bind end: %s", item->rsp != NULL ? "success" : errstr); + if (kerr) { + krb5_free_error_message(ctx.kctx, errstr); + } + ldap_msgfree(results); otpd_queue_push(&ctx.stdio.responses, item); verto_set_flags(ctx.stdio.writer, VERTO_EV_FLAG_PERSIST | diff --git a/daemons/ipa-otpd/forward.c b/daemons/ipa-otpd/forward.c index e6ae1e9d2..77241ec3b 100644 --- a/daemons/ipa-otpd/forward.c +++ b/daemons/ipa-otpd/forward.c @@ -43,10 +43,14 @@ static void forward_cb(krb5_error_code retval, const krad_packet *request, NULL, item->req, &item->rsp); } - otpd_log_req(item->req, "forward end: %s", - retval == 0 - ? krad_code_num2name(code) - : krb5_get_error_message(ctx.kctx, retval)); + if (retval == 0) { + otpd_log_req(item->req, "forward end: %s", krad_code_num2name(code)); + } else { + const char *err_msg = krb5_get_error_message(ctx.kctx, retval); + otpd_log_req(item->req, "forward end: %s", + krb5_get_error_message(ctx.kctx, retval)); + krb5_free_error_message(ctx.kctx, err_msg); + } otpd_queue_push(&ctx.stdio.responses, item); verto_set_flags(ctx.stdio.writer, VERTO_EV_FLAG_PERSIST | @@ -117,8 +121,10 @@ krb5_error_code otpd_forward(struct otpd_queue_item **item) *item = NULL; error: - if (retval != 0) - otpd_log_req((*item)->req, "forward end: %s", - krb5_get_error_message(ctx.kctx, retval)); + if (retval != 0) { + const char *err_msg = krb5_get_error_message(ctx.kctx, retval); + otpd_log_req((*item)->req, "forward end: %s", err_msg); + krb5_free_error_message(ctx.kctx, err_msg); + } return retval; } diff --git a/util/ipa_krb5.c b/util/ipa_krb5.c index 2e663c506..bb98ab897 100644 --- a/util/ipa_krb5.c +++ b/util/ipa_krb5.c @@ -904,6 +904,7 @@ static int prep_ksdata(krb5_context krbctx, const char *str, ksdata = calloc(n + 1, sizeof(struct krb_key_salt)); if (NULL == ksdata) { *err_msg = _("Out of memory!?\n"); + ipa_krb5_free_ktypes(krbctx, ktypes); return 0; }