krb5/krb5 — pull request #158 by nalind (2014-06-19 15:36:43+00:00)
Title: Prevent a write-to-NULL in encrypt_credencpart()

If krb5_encrypt_helper() returns an error, the ciphertext structure
may contain a non-zero length, but it will already have freed the
pointer to its data, making encrypt_credencpart()'s subsequent attempt
to clear and free the memory fail.

If krb5_encrypt_helper() encounters an error, clear the memory
before freeing it, and make sure that we don't return a non-zero
ciphertext length. Because we know that krb5_encrypt_helper()
will only return an empty ciphertext data structure on error, stop
trying to clean it up in encrypt_credencpart().

Based on a patch from Jatin Nansi.