Summary

An incorrect free when decoding target information can trigger a denial of service.

Details

The error condition incorrectly assumed the cb and sh buffers would contain a copy of the data that needed to be freed. However that is not the case.

Impact

This vulnerability can be triggered via the main gss_accept_sec_context entry point. This will likely trigger an assertion failure in free, causing a denial-of-service.