Heap corruption in ipapwd plugin

ipapwd_encrypt_encode_key allocates 'kset' on the heap but
with num_keys and keys not being initialized.
Then ipa_krb5_generate_key_data initializes them with the
generated keys.
If ipa_krb5_generate_key_data fails (here EINVAL meaning no
principal->realm.data), num_keys and keys are left uninitialized.
Upon failure, ipapwd_keyset_free is called to free 'kset'
that contains random num_keys and keys.

allocates kset with calloc so that kset->num_keys==0 and
kset->keys==NULL

https://fedorahosted.org/freeipa/ticket/6030

Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>

daemons/ipa-slapi-plugins/ipa-pwd-extop/encoding.c

@@ -157,7 +157,7 @@ Slapi_Value **ipapwd_encrypt_encode_key(struct ipapwd_krbcfg *krbcfg,
         pwd.length = strlen(data->password);
     }
 
-    kset = malloc(sizeof(struct ipapwd_keyset));
+    kset = (struct ipapwd_keyset *) calloc(1, sizeof(struct ipapwd_keyset));
     if (!kset) {
         LOG_OOM();
         goto enc_error;