From: Luke Howard <lukeh@padl.com>
Date: Wed, 9 Mar 2011 13:53:44 +0000 (+1100)
Subject: don't leak Kerberos context if reauth not supported
X-Git-Tag: vm/20110310~15
X-Git-Url: http://www.project-moonshot.org/gitweb/?a=commitdiff_plain;ds=sidebyside;h=ef7242d8e4b355b1565ca20761c7e95f48185fdf;p=moonshot.git

don't leak Kerberos context if reauth not supported
---

diff --git a/mech_eap/init_sec_context.c b/mech_eap/init_sec_context.c
index cef79d1..b9693df 100644
--- a/mech_eap/init_sec_context.c
+++ b/mech_eap/init_sec_context.c
@@ -574,9 +574,12 @@ eapGssSmInitIdentity(OM_uint32 *minor,
     struct eap_config eapConfig;
 
     if (GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_REAUTHENTICATE) {
+        OM_uint32 tmpMinor;
+
         /* server didn't support reauthentication, sent EAP request */
-        GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
+        gssDeleteSecContext(&tmpMinor, &ctx->kerberosCtx, GSS_C_NO_BUFFER);
         ctx->flags &= ~(CTX_FLAG_KRB_REAUTH);
+        GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
         *smFlags |= SM_FLAG_RESTART;
     } else {
         *smFlags |= SM_FLAG_FORCE_SEND_TOKEN;