Re: [kitten] New Version Notification for draft-kaduk-kitten-gss-loop-02.txt (fwd)

[Russ Allbery <[e-mail]>]

Nico Williams <[e-mail]> writes:

> The C bindings release/delete functions generally take a pointer to a
> variable that holds the thing being released precisely so they can set
> that variable to the appropriate GSS_C_NO_* value.

I think Martin's point is that the following is not safe:

    gss_buffer_desc buf1, buf2;
    gss_OID oid;
    gss_name_t name;
    OM_uint32 major, minor;

    /* ... */

    major = gss_display_name(&minor, name, &buf1, &oid);
    buf2 = buf1;
    gss_release_buffer(&minor, &buf1);
    gss_release_buffer(&minor, &buf2);

Similar sorts of code work with other GSS-API objects.  It doesn't really
matter whether the variable type is actually a struct or a pointer; either
way, once you start making copies, double frees are still a risk.

Now, obviously, you generally should avoid doing that sort of thing in
GSS-API code precisely because it's not safe.  But saying that it's
permissible to pass the same buffer to gss_release_buffer multiple times
implies that this sort of thing is safe, and I'm pretty sure it isn't.

-- 
Russ Allbery ([e-mail])              <http://www.eyrie.org/~eagle/>