[Bug 1601] New: Memory leak caused by forwarded GSSAPI credential store

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=1601

           Summary: Memory leak caused by forwarded GSSAPI credential
                    store
           Product: Portable OpenSSH
           Version: 5.2p1
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: sshd
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: miguel.sanders at arcelormittal.com
                CC: miguel.sanders at arcelormittal.com


Created an attachment (id=1641)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1641)
Fix for memory leak

While debugging a GSSAPI memory allocation problem not related to
OpenSSH, I found a memory leak in OpenSSH when storing forwarded GSSAPI
credentials resulting in a growing process segment for each connection
that uses GSSAPI credentials forwarding. What happens is the following:
In the privileged parent, we are calling ssh_gssapi_storecreds() which
itself calls ssh_gssapi_krb5_storecreds(). ssh_gssapi_krb5_storecreds()
makes some memory allocations in order to save the credentials store
for the gssapi client.

  +167          client->store.filename =
xstrdup(krb5_cc_get_name(krb_context, ccache));
  +168          client->store.envvar = "KRB5CCNAME";
  +169          len = strlen(client->store.filename) + 6;
  +170          client->store.envval = xmalloc(len);
  +171          snprintf(client->store.envval, len, "FILE:%s",
client->store.filename);

Those memory allocations are never freed. Moreover, since those memory
allocations are done in the privileged parent (which is a finite-state
machine and never returns) before forking the unprivileged child, the
memory leak gets doubled for each connection that uses GSSAPI
credential forwarding.

A solution would be the following:
1) Migrate the ssh_gssapi_storecreds() call to the unprivileged child
2) Create a ssh_gssapi_free_store() call in gss-serv.c which frees the
memory allocations. At first I was thinking of integrating this in the
ssh_gssapi_cleanup_creds() call but freeing the memory is mandatory
while the cleanup of credentials is the user's choice.
3) Integrate ssh_gssapi_free_store() call in the do_cleanup() call,
which is located in session.c.

I added a patch which solved this issue.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.