r24128: fix double free in error path

metze
(This used to be commit 29e2d8e044c9213643a2f5f29891ce853a839347)

diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index 5c4006e7697e85ca1f992e878ef74e095ec7b1ff..c727c8b50ac1c31892e6e91604594b54e2b08447 100644 (file)
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -962,11 +962,10 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
                                          &output_token,
                                          &ret_flags,
                                          NULL);
-
-               if (input_token.value) {
-                       gss_release_buffer(&minor_status, &input_token);
+               if (scred) {
+                       ber_bvfree(scred);
+                       scred = NULL;
                }
-
                if (gss_rc && gss_rc != GSS_S_CONTINUE_NEEDED) {
                        status = ADS_ERROR_GSS(gss_rc, minor_status);
                        goto failed;
@@ -999,13 +998,15 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
 
        gss_rc = gss_unwrap(&minor_status,context_handle,&input_token,&output_token,
                            &conf_state,NULL);
+       if (scred) {
+               ber_bvfree(scred);
+               scred = NULL;
+       }
        if (gss_rc) {
                status = ADS_ERROR_GSS(gss_rc, minor_status);
                goto failed;
        }
 
-       gss_release_buffer(&minor_status, &input_token);
-
        p = (uint8 *)output_token.value;
 
 #if 0