summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/mit-krb5-CVE-2015-8631.patch
diff options
context:
space:
mode:
authorMark H Weaver <mhw@netris.org>2016-02-04 02:02:20 -0500
committerMark H Weaver <mhw@netris.org>2016-02-10 10:41:11 -0500
commit16114c3494026b908b116bf93b9eee5d871860ef (patch)
treeefca01aac6efa9edfd3f2ec3bed86859a91b66af /gnu/packages/patches/mit-krb5-CVE-2015-8631.patch
parent42395bf5143b39a7b79520a94e825be472692482 (diff)
gnu: mit-krb5: Update to 1.13.3; add fixes for CVE-2015-{8629,8630,8631}.
* gnu/packages/patches/mit-krb5-CVE-2015-2695-pt1.patch, gnu/packages/patches/mit-krb5-CVE-2015-2695-pt2.patch, gnu/packages/patches/mit-krb5-CVE-2015-2696.patch, gnu/packages/patches/mit-krb5-CVE-2015-2697.patch, gnu/packages/patches/mit-krb5-CVE-2015-2698-pt1.patch, gnu/packages/patches/mit-krb5-CVE-2015-2698-pt2.patch: Delete files. * gnu/packages/patches/mit-krb5-CVE-2015-8629.patch, gnu/packages/patches/mit-krb5-CVE-2015-8630.patch, gnu/packages/patches/mit-krb5-CVE-2015-8631.patch, gnu/packages/patches/mit-krb5-init-context-null-spnego.patch: New files. * gnu-system.am (dist_patch_DATA): Adjust accordingly. * gnu/packages/mit-krb5.scm (mit-krb5): Update to 1.13.3. [source]: Update URI to download conventional .tar.gz file. Add patches. [native-inputs]: Remove old patches-as-inputs. [arguments]: Remove hacks needed to cope with the older unconventional tarball that contained an inner source tarball and signature: Remove #:modules argument, and the custom 'unpack' and 'apply-patches' phases.
Diffstat (limited to 'gnu/packages/patches/mit-krb5-CVE-2015-8631.patch')
-rw-r--r--gnu/packages/patches/mit-krb5-CVE-2015-8631.patch576
1 files changed, 576 insertions, 0 deletions
diff --git a/gnu/packages/patches/mit-krb5-CVE-2015-8631.patch b/gnu/packages/patches/mit-krb5-CVE-2015-8631.patch
new file mode 100644
index 0000000000..dd1eb2945c
--- /dev/null
+++ b/gnu/packages/patches/mit-krb5-CVE-2015-8631.patch
@@ -0,0 +1,576 @@
+Copied from Fedora.
+http://pkgs.fedoraproject.org/cgit/rpms/krb5.git/tree/krb5-CVE-2015-8631.patch?h=f22
+
+From 83ed75feba32e46f736fcce0d96a0445f29b96c2 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 8 Jan 2016 13:16:54 -0500
+Subject: [PATCH 3/3] Fix leaks in kadmin server stubs [CVE-2015-8631]
+
+In each kadmind server stub, initialize the client_name and
+server_name variables, and release them in the cleanup handler. Many
+of the stubs will otherwise leak the client and server name if
+krb5_unparse_name() fails. Also make sure to free the prime_arg
+variables in rename_principal_2_svc(), or we can leak the first one if
+unparsing the second one fails. Discovered by Simo Sorce.
+
+CVE-2015-8631:
+
+In all versions of MIT krb5, an authenticated attacker can cause
+kadmind to leak memory by supplying a null principal name in a request
+which uses one. Repeating these requests will eventually cause
+kadmind to exhaust all available memory.
+
+ CVSSv2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C
+
+ticket: 8343 (new)
+target_version: 1.14-next
+target_version: 1.13-next
+tags: pullup
+---
+ src/kadmin/server/server_stubs.c | 151 ++++++++++++++++++++-------------------
+ 1 file changed, 77 insertions(+), 74 deletions(-)
+
+diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
+index 1879dc6..6ac797e 100644
+--- a/src/kadmin/server/server_stubs.c
++++ b/src/kadmin/server/server_stubs.c
+@@ -334,7 +334,8 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name, service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ restriction_t *rp;
+@@ -382,10 +383,10 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
+- gss_release_buffer(&minor_stat, &client_name);
+- gss_release_buffer(&minor_stat, &service_name);
+
+ exit_func:
++ gss_release_buffer(&minor_stat, &client_name);
++ gss_release_buffer(&minor_stat, &service_name);
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -395,7 +396,8 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name, service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ restriction_t *rp;
+@@ -444,10 +446,10 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
+- gss_release_buffer(&minor_stat, &client_name);
+- gss_release_buffer(&minor_stat, &service_name);
+
+ exit_func:
++ gss_release_buffer(&minor_stat, &client_name);
++ gss_release_buffer(&minor_stat, &service_name);
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -457,8 +459,8 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -501,10 +503,10 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
+
+ }
+ free(prime_arg);
+- gss_release_buffer(&minor_stat, &client_name);
+- gss_release_buffer(&minor_stat, &service_name);
+
+ exit_func:
++ gss_release_buffer(&minor_stat, &client_name);
++ gss_release_buffer(&minor_stat, &service_name);
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -514,8 +516,8 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ restriction_t *rp;
+@@ -559,9 +561,9 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -570,10 +572,9 @@ generic_ret *
+ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+- char *prime_arg1,
+- *prime_arg2;
+- gss_buffer_desc client_name,
+- service_name;
++ char *prime_arg1 = NULL, *prime_arg2 = NULL;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ restriction_t *rp;
+@@ -655,11 +656,11 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+
+ }
++exit_func:
+ free(prime_arg1);
+ free(prime_arg2);
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -669,8 +670,8 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)
+ {
+ static gprinc_ret ret;
+ char *prime_arg, *funcname;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -719,9 +720,9 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -731,8 +732,8 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)
+ {
+ static gprincs_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -777,9 +778,9 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+
+ }
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -789,8 +790,8 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -840,9 +841,9 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
+ }
+
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -852,8 +853,8 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -909,9 +910,9 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
+ }
+
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -921,8 +922,8 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -969,9 +970,9 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
+ }
+
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -981,8 +982,8 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1029,9 +1030,9 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
+ }
+
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1041,8 +1042,8 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1092,9 +1093,9 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
+ }
+
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1106,8 +1107,8 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)
+ krb5_keyblock *k;
+ int nkeys;
+ char *prime_arg, *funcname;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1164,9 +1165,9 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1178,8 +1179,8 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)
+ krb5_keyblock *k;
+ int nkeys;
+ char *prime_arg, *funcname;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1241,9 +1242,9 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1253,8 +1254,8 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1295,9 +1296,9 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)
+ if (errmsg != NULL)
+ krb5_free_error_message(handle->context, errmsg);
+ }
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1307,8 +1308,8 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1347,9 +1348,9 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)
+ if (errmsg != NULL)
+ krb5_free_error_message(handle->context, errmsg);
+ }
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1359,8 +1360,8 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1400,9 +1401,9 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)
+ if (errmsg != NULL)
+ krb5_free_error_message(handle->context, errmsg);
+ }
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1413,8 +1414,8 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
+ static gpol_ret ret;
+ kadm5_ret_t ret2;
+ char *prime_arg, *funcname;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_principal_ent_rec caller_ent;
+ kadm5_server_handle_t handle;
+@@ -1475,9 +1476,9 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
+ log_unauth(funcname, prime_arg,
+ &client_name, &service_name, rqstp);
+ }
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+
+@@ -1488,8 +1489,8 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)
+ {
+ static gpols_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1531,9 +1532,9 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)
+ if (errmsg != NULL)
+ krb5_free_error_message(handle->context, errmsg);
+ }
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1541,7 +1542,8 @@ exit_func:
+ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
+ {
+ static getprivs_ret ret;
+- gss_buffer_desc client_name, service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1571,9 +1573,9 @@ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
+ if (errmsg != NULL)
+ krb5_free_error_message(handle->context, errmsg);
+
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1583,7 +1585,8 @@ purgekeys_2_svc(purgekeys_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg, *funcname;
+- gss_buffer_desc client_name, service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+
+@@ -1629,9 +1632,9 @@ purgekeys_2_svc(purgekeys_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1641,8 +1644,8 @@ get_strings_2_svc(gstrings_arg *arg, struct svc_req *rqstp)
+ {
+ static gstrings_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1688,9 +1691,9 @@ get_strings_2_svc(gstrings_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1700,8 +1703,8 @@ set_string_2_svc(sstring_arg *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+ char *prime_arg;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ OM_uint32 minor_stat;
+ kadm5_server_handle_t handle;
+ const char *errmsg = NULL;
+@@ -1744,9 +1747,9 @@ set_string_2_svc(sstring_arg *arg, struct svc_req *rqstp)
+ krb5_free_error_message(handle->context, errmsg);
+ }
+ free(prime_arg);
++exit_func:
+ gss_release_buffer(&minor_stat, &client_name);
+ gss_release_buffer(&minor_stat, &service_name);
+-exit_func:
+ free_server_handle(handle);
+ return &ret;
+ }
+@@ -1754,8 +1757,8 @@ exit_func:
+ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
+ {
+ static generic_ret ret;
+- gss_buffer_desc client_name,
+- service_name;
++ gss_buffer_desc client_name = GSS_C_EMPTY_BUFFER;
++ gss_buffer_desc service_name = GSS_C_EMPTY_BUFFER;
+ kadm5_server_handle_t handle;
+ OM_uint32 minor_stat;
+ const char *errmsg = NULL;
+@@ -1797,10 +1800,10 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
+ rqstp->rq_cred.oa_flavor);
+ if (errmsg != NULL)
+ krb5_free_error_message(NULL, errmsg);
+- gss_release_buffer(&minor_stat, &client_name);
+- gss_release_buffer(&minor_stat, &service_name);
+
+ exit_func:
++ gss_release_buffer(&minor_stat, &client_name);
++ gss_release_buffer(&minor_stat, &service_name);
+ return(&ret);
+ }
+
+--
+2.7.0.rc3
+