Segfault in authGSSClientWrap caused by freeing a stack allocated buffer (pykerberos >= 1.1.6)

[behackett]

The regression occurred in version 1.1.6 with the following commit: 1de650c.

The author of that patch added a call to gss_release_buffer on input_token.value at the end of the function:

https://github.com/02strich/pykerberos/blob/v1.1.10/src/kerberosgss.c#L606-L607

The problem is that input_token.value is a stack allocated buffer:

https://github.com/02strich/pykerberos/blob/v1.1.10/src/kerberosgss.c#L560-L576

If authGSSClientWrap is called with the "user" option the interpreter segfaults. Here is the backtrace from gdb (with sensitive data redacted):

(gdb) bt
#0  0x00007f93bb0e7297 in raise () from /lib64/libc.so.6
#1  0x00007f93bb0e862a in abort () from /lib64/libc.so.6
#2  0x00007f93bb125ce0 in __libc_message () from /lib64/libc.so.6
#3  0x00007f93bb12b19e in malloc_printerr () from /lib64/libc.so.6
#4  0x00007f93bb12b98b in _int_free () from /lib64/libc.so.6
#5  0x00007f93b9a9abf8 in gss_release_buffer () from /usr/lib64/libgssapi_krb5.so.2
#6  0x00007f93b9cd0cbc in authenticate_gss_client_wrap (state=0xdf1560, challenge=0x7f93affc80e4 "redacted", 
    user=0x7f93b506cbd4 "redacted", protect=0) at src/kerberosgss.c:607
#7  0x00007f93b9cce8c3 in authGSSClientWrap (self=0x0, 
    args=(<PyCObject at remote 0x7f93b5067328>, 'redacted', u'redacted')) at src/kerberos.c:318

Remove the gss_release_buffer call. It would also be useful to add a test for authGSSClientUnwrap and authGSSClientWrap to avoid future regressions.

[02strich]

Yes, this part needs a lot more testing, Sadly I currently don't have the time to write them :(

[02strich]

thanks for the fix

[behackett]

Happy to help. :-)

[behackett]

@02strich can we get a release cut for this?

[02strich]

Sure, I will cut one tonight when I get home

[behackett]

Thanks!

[02strich]

Released as 1.1.11