From 15de71ae61b0f97689bc8cf38256446f3e7922c1 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Aug 15 2024 08:10:34 +0000
Subject: Fix some resource leaks identified by a static analyzer


Fixes: https://pagure.io/freeipa/issue/9367

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>

---

diff --git a/client/ipa-getkeytab.c b/client/ipa-getkeytab.c
index cda5b12..228b981 100644
--- a/client/ipa-getkeytab.c
+++ b/client/ipa-getkeytab.c
@@ -266,6 +266,7 @@ static int ldap_sasl_interact(LDAP *ld, unsigned flags, void *priv_data, void *s
                                 error_message(krberr), krberr);
 				in->result = NULL;
 				in->len = 0;
+				krb5_free_context(krbctx);
 				ret = LDAP_LOCAL_ERROR;
 				break;
 			}
diff --git a/client/ipa-rmkeytab.c b/client/ipa-rmkeytab.c
index caa0352..7803241 100644
--- a/client/ipa-rmkeytab.c
+++ b/client/ipa-rmkeytab.c
@@ -29,6 +29,11 @@
 #include "ipa-client-common.h"
 #include "config.h"
 
+int remove_principal(krb5_context context, krb5_keytab ktid,
+                     const char *principal, int debug);
+int remove_realm(krb5_context context, krb5_keytab ktid,
+                 const char *realm, int debug);
+
 #define KERBEROS_ERROR	1
 #define OOM_ERROR		2
 #define KEYTAB_ERROR	3
@@ -171,7 +176,8 @@ remove_realm(krb5_context context, krb5_keytab ktid, const char *realm, int debu
     }
 
 done:
-
+    krb5_kt_end_seq_get(context, ktid, &kt_cursor);
+    krb5_free_unparsed_name(context, entry_princ_s);
     return rval;
 }
 
diff --git a/daemons/ipa-kdb/ipa_kdb_principals.c b/daemons/ipa-kdb/ipa_kdb_principals.c
index 6a26849..14603e5 100644
--- a/daemons/ipa-kdb/ipa_kdb_principals.c
+++ b/daemons/ipa-kdb/ipa_kdb_principals.c
@@ -2066,6 +2066,7 @@ void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry)
                 for (i = 0; (acl_list != NULL) && (acl_list[i] != NULL); i++) {
                     free(acl_list[i]);
                 }
+                free(acl_list);
             }
             free(prev->tl_data_contents);
             free(prev);
diff --git a/daemons/ipa-otpd/bind.c b/daemons/ipa-otpd/bind.c
index 61efe4d..a6fde07 100644
--- a/daemons/ipa-otpd/bind.c
+++ b/daemons/ipa-otpd/bind.c
@@ -79,6 +79,7 @@ static void on_bind_readable(verto_ctx *vctx, verto_ev *ev)
     struct otpd_queue_item *item = NULL;
     int i, rslt;
     (void)vctx;
+    int kerr = 0;
 
     rslt = ldap_result(verto_get_private(ev), LDAP_RES_ANY, 0, NULL, &results);
     if (rslt != LDAP_RES_BIND) {
@@ -118,6 +119,7 @@ static void on_bind_readable(verto_ctx *vctx, verto_ev *ev)
                                  krad_code_name2num("Access-Accept"),
                                  NULL, item->req, &item->rsp);
     if (i != 0) {
+        kerr = 1;
         errstr = krb5_get_error_message(ctx.kctx, i);
         goto error;
     }
@@ -127,6 +129,10 @@ error:
         otpd_log_req(item->req, "bind end: %s",
                 item->rsp != NULL ? "success" : errstr);
 
+    if (kerr) {
+        krb5_free_error_message(ctx.kctx, errstr);
+    }
+
     ldap_msgfree(results);
     otpd_queue_push(&ctx.stdio.responses, item);
     verto_set_flags(ctx.stdio.writer, VERTO_EV_FLAG_PERSIST |
diff --git a/daemons/ipa-otpd/forward.c b/daemons/ipa-otpd/forward.c
index e6ae1e9..77241ec 100644
--- a/daemons/ipa-otpd/forward.c
+++ b/daemons/ipa-otpd/forward.c
@@ -43,10 +43,14 @@ static void forward_cb(krb5_error_code retval, const krad_packet *request,
                                           NULL, item->req, &item->rsp);
     }
 
-    otpd_log_req(item->req, "forward end: %s",
-            retval == 0
-                ? krad_code_num2name(code)
-                : krb5_get_error_message(ctx.kctx, retval));
+    if (retval == 0) {
+        otpd_log_req(item->req, "forward end: %s", krad_code_num2name(code));
+    } else {
+        const char *err_msg = krb5_get_error_message(ctx.kctx, retval);
+        otpd_log_req(item->req, "forward end: %s",
+                     krb5_get_error_message(ctx.kctx, retval));
+        krb5_free_error_message(ctx.kctx, err_msg);
+    }
 
     otpd_queue_push(&ctx.stdio.responses, item);
     verto_set_flags(ctx.stdio.writer, VERTO_EV_FLAG_PERSIST |
@@ -117,8 +121,10 @@ krb5_error_code otpd_forward(struct otpd_queue_item **item)
         *item = NULL;
 
 error:
-    if (retval != 0)
-        otpd_log_req((*item)->req, "forward end: %s",
-                krb5_get_error_message(ctx.kctx, retval));
+    if (retval != 0) {
+        const char *err_msg = krb5_get_error_message(ctx.kctx, retval);
+        otpd_log_req((*item)->req, "forward end: %s", err_msg);
+        krb5_free_error_message(ctx.kctx, err_msg);
+    }
     return retval;
 }
diff --git a/util/ipa_krb5.c b/util/ipa_krb5.c
index 2e663c5..bb98ab8 100644
--- a/util/ipa_krb5.c
+++ b/util/ipa_krb5.c
@@ -904,6 +904,7 @@ static int prep_ksdata(krb5_context krbctx, const char *str,
         ksdata = calloc(n + 1, sizeof(struct krb_key_salt));
         if (NULL == ksdata) {
             *err_msg = _("Out of memory!?\n");
+            ipa_krb5_free_ktypes(krbctx, ktypes);
             return 0;
         }