Ah sorry for that. I made a new patch that should work.
//Tomas Björklund IT-department Stockholm University 106 91 Stockholm www.su.se/it<http://www.su.se/it> <http://www.su.se/it> <https://www.su.se/om-webbplatsen-1.517562> ________________________________ From: Brian May <[email protected]> Sent: Sunday, 2 August 2026 07:26:22 To: Tomas Björklund; [email protected] Subject: Re: Bug#1142981: libgssapi3t64-heimdal: memory leak in _gss_ntlm_allocate_ctx during SASL GSSAPI binds My computer is attempting to tell me that the patch as malformed: git apply --check /tmp/0033-ntlm-fix-memory-leaks.patch error: corrupt patch at /tmp/0033-ntlm-fix-memory-leaks.patch:73 i.e. was expecting 73 line patch, but 72 lines. Please can you check? -- Brian May @ Debian
Description: ntlm: fix memory leaks in acceptor probe and credential paths Origin: upstream, backport Forwarded: not-needed Bug-Debian: https://bugs.debian.org/ Last-Update: 2026-08-03 diff --git a/lib/gssapi/ntlm/accept_sec_context.c b/lib/gssapi/ntlm/accept_sec_context.c index 7ba55cd33..a0b3f4ae3 100644 --- a/lib/gssapi/ntlm/accept_sec_context.c +++ b/lib/gssapi/ntlm/accept_sec_context.c @@ -163,12 +163,14 @@ _gss_ntlm_accept_sec_context output_token->value = malloc(out.length); if (output_token->value == NULL && out.length != 0) { OM_uint32 gunk; + heim_ntlm_free_buf(&out); _gss_ntlm_delete_sec_context(&gunk, context_handle, NULL); *minor_status = ENOMEM; return GSS_S_FAILURE; } memcpy(output_token->value, out.data, out.length); output_token->length = out.length; + heim_ntlm_free_buf(&out); ctx->flags = retflags; diff --git a/lib/gssapi/ntlm/kdc.c b/lib/gssapi/ntlm/kdc.c index 06d738206..0c9a56351 100644 --- a/lib/gssapi/ntlm/kdc.c +++ b/lib/gssapi/ntlm/kdc.c @@ -86,7 +86,7 @@ get_ccache(krb5_context context, int *destroy, krb5_ccache *id) ret = krb5_cc_cache_match(context, principal, id); if (ret == 0) - return 0; + goto out; /* did not find in default credcache, lets try default keytab */ ret = krb5_kt_default(context, &kt); diff --git a/lib/gssapi/ntlm/release_cred.c b/lib/gssapi/ntlm/release_cred.c index 49d88a2b2..e31a31611 100644 --- a/lib/gssapi/ntlm/release_cred.c +++ b/lib/gssapi/ntlm/release_cred.c @@ -58,6 +58,9 @@ OM_uint32 GSSAPI_CALLCONV _gss_ntlm_release_cred free(cred->key.data); } + memset(cred, 0, sizeof(*cred)); + free(cred); + return GSS_S_COMPLETE; }
