<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<DIV>Hi,</DIV>
<DIV> </DIV>
<DIV> I looked at memory leaks for the squid negotiate_kerberos
helper and found issues with the following in the heimdal code:</DIV>
<DIV> </DIV>
<DIV>==9424== 16 bytes in 1 blocks are definitely lost in loss record 13 of
64</DIV>
<DIV>==9424== at 0x4C2A110: malloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)</DIV>
<DIV>==9424== by 0x52ACF9C: set_etypes (context.c:74)</DIV>
<DIV>==9424== by 0x52ADE8F: init_context_from_config_file
(context.c:161)</DIV>
<DIV>==9424== by 0x52ADE8F: krb5_set_config_files
(context.c:692)</DIV>
<DIV>==9424== by 0x52AE49C: krb5_init_context
(context.c:451)</DIV>
<DIV>==9424== by 0x4023C1: main
(negotiate_kerberos_auth.cc:549)</DIV>
<DIV> </DIV>
<DIV>which should be fixed with</DIV>
<DIV> </DIV>
<DIV>--- lib/krb5/context.c 2017-12-07 04:11:23.000000000 +0000</DIV>
<DIV>+++ lib/krb5/context_new.c 2018-09-15
18:45:40.715744342 +0100</DIV>
<DIV>@@ -622,6 +622,9 @@</DIV>
<DIV> free(context->etypes);</DIV>
<DIV> free(context->cfg_etypes);</DIV>
<DIV> free(context->etypes_des);</DIV>
<DIV>+ free(context->permitted_enctypes);</DIV>
<DIV>+ free(context->tgs_etypes);</DIV>
<DIV>+ free(context->as_etypes);</DIV>
<DIV> krb5_free_host_realm (context,
context->default_realms);</DIV>
<DIV> krb5_config_file_free (context,
context->cf);</DIV>
<DIV> free_error_table (context->et_list);</DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>and </DIV>
<DIV> </DIV>
<DIV>==9424== 13,200 bytes in 6 blocks are definitely lost in loss record 63 of
64</DIV>
<DIV>==9424== at 0x4C2C240: calloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)</DIV>
<DIV>==9424== by 0x4E5E01A: _gss_ntlm_allocate_ctx
(accept_sec_context.c:52)</DIV>
<DIV>==9424== by 0x4E5E5B4: _gss_ntlm_acquire_cred
(acquire_cred.c:60)</DIV>
<DIV>==9424== by 0x4E55779: gss_acquire_cred
(gss_acquire_cred.c:125)</DIV>
<DIV>==9424== by 0x4E635AB: _gss_spnego_acquire_cred
(cred_stubs.c:109)</DIV>
<DIV>==9424== by 0x4E55779: gss_acquire_cred
(gss_acquire_cred.c:125)</DIV>
<DIV>==9424== by 0x403227: main
(negotiate_kerberos_auth.cc:721)</DIV>
<DIV> </DIV>
<DIV>Which could be fixed with</DIV>
<DIV> </DIV>
<DIV>--- ./lib/gssapi/ntlm/acquire_cred.c 2016-12-20
14:23:06.000000000 +0000</DIV>
<DIV>+++
./lib/gssapi/ntlm/acquire_cred_new.c
2018-09-15 18:09:04.436985518 +0100</DIV>
<DIV>@@ -58,8 +58,10 @@</DIV>
<DIV> if (cred_usage == GSS_C_BOTH || cred_usage ==
GSS_C_ACCEPT) {</DIV>
<DIV> </DIV>
<DIV> maj_stat =
_gss_ntlm_allocate_ctx(min_stat, &ctx);</DIV>
<DIV>- if (maj_stat != GSS_S_COMPLETE)</DIV>
<DIV>+ if (maj_stat != GSS_S_COMPLETE)
{</DIV>
<DIV>+ if (ctx)
free(ctx);</DIV>
<DIV> return
maj_stat;</DIV>
<DIV>+ }</DIV>
<DIV> </DIV>
<DIV> domain = name != NULL ?
name->domain : NULL;</DIV>
<DIV> maj_stat =
(*ctx->server->nsi_probe)(min_stat, ctx->ictx, domain);</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Markus</DIV>
<DIV> </DIV>
<DIV> </DIV></DIV></DIV></BODY></HTML>