search

gssapi / gssproxy

A proxy for GSSAPI | Docs at https://github.com/gssapi/gssproxy/tree/main/docs
Other
44 stars 29 forks source link

Security context mech oids should be static #9

Closed frozencemetery closed 4 years ago

frozencemetery commented 4 years ago

Per RFC 274 section 5.1:

   mech_type            Object ID, modify, optional Security mechanism
                        used.  The returned OID value will be a pointer
                        into static storage, and should be treated as
            read-only by the caller (in particular, it does
                        not need to be freed).  If not required, specify
                        NULL.

This assumption is shared by the krb5 mechglue, which assumes this parameter can be requested without needing additional memory overhead. However, this causes the following valgrind trace from t_acquire (test_0.log):

==38725== 25 (16 direct, 9 indirect) bytes in 1 blocks are definitely lost in loss record 14 of 67
==38725==    at 0x483BAE9: calloc (vg_replace_malloc.c:760)
==38725==    by 0x53E325D: gp_conv_gssx_to_oid_alloc (gp_conv.c:82)
==38725==    by 0x53E8B04: gpm_accept_sec_context (gpm_accept_sec_context.c:75)
==38725==    by 0x53EFCCD: gssi_accept_sec_context (gpp_accept_sec_context.c:101)
==38725==    by 0x488ADF2: gss_accept_sec_context (g_accept_sec_context.c:266)
==38725==    by 0x401AD8: main (t_acquire.c:83)