I have been using copilot to help me look into the heaptrack and also what can help with the leaks. I attach a small patch that "he" says will fix the leaks. Please have a look at it if removing ntlm like upstream is not an option.
//Tomas Björklund IT-department Stockholm University 106 91 Stockholm www.su.se/it<http://www.su.se/it> <http://www.su.se/it> <https://www.su.se/om-webbplatsen-1.517562> ________________________________ From: Tomas Björklund Sent: Friday, 31 July 2026 09:09:08 To: Brian May; [email protected] Subject: Re: Bug#1142981: libgssapi3t64-heimdal: memory leak in _gss_ntlm_allocate_ctx during SASL GSSAPI binds I found that upstream has removed the ntlm code totally in this commit cbe156d9279effd6780fc36b620321e373217863 //Tomas Björklund IT-department Stockholm University 106 91 Stockholm www.su.se/it<http://www.su.se/it> <http://www.su.se/it> <https://www.su.se/om-webbplatsen-1.517562> ________________________________ From: Tomas Björklund Sent: Friday, 31 July 2026 08:46:49 To: Brian May; [email protected] Subject: Re: Bug#1142981: libgssapi3t64-heimdal: memory leak in _gss_ntlm_allocate_ctx during SASL GSSAPI binds I don't know if there is any upstream fix for this. //Tomas Björklund IT-department Stockholm University 106 91 Stockholm www.su.se/it<http://www.su.se/it> <http://www.su.se/it> <https://www.su.se/om-webbplatsen-1.517562> ________________________________ From: Brian May <[email protected]> Sent: Friday, 31 July 2026 01:15:53 To: Tomas Björklund; [email protected] Subject: Re: Bug#1142981: libgssapi3t64-heimdal: memory leak in _gss_ntlm_allocate_ctx during SASL GSSAPI binds Tomas Björklund <[email protected]> writes: > I have observed a significant memory leak in Heimdal GSSAPI when used > by slapd with SASL GSSAPI authentication. Do you know if there is any upstream fix for this? -- Brian May @ Debian
From: Tomas Björklund [email protected] Date: 2026-07-31 Subject: [PATCH] ntlm: fix memory leaks in acceptor probe and credential paths Description: Fix three memory leaks in the legacy NTLM GSS mechanism. - lib/gssapi/ntlm/kdc.c: avoid early return in get_ccache() that skips cleanup and leaks principal. - lib/gssapi/ntlm/release_cred.c: free the ntlm_cred object itself after releasing embedded fields. - lib/gssapi/ntlm/accept_sec_context.c: free the type2 output buffer once copied into output_token and on malloc failure path. Origin: upstream, backport Forwarded: not-needed Bug-Debian: https://bugs.debian.org/ Last-Update: 2026-07-31 This backports upstream fixes equivalent to: - 27e5c40a798fd213a9ecfe48dbb133ca0173ebda - a666bf165ea3aadd36e95a3c53dcc291b3bcb39a - 8526b4c627f354729bade193b7e132e27d861a19 --- lib/gssapi/ntlm/accept_sec_context.c | 2 ++ lib/gssapi/ntlm/kdc.c | 2 +- lib/gssapi/ntlm/release_cred.c | 3 +++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/gssapi/ntlm/accept_sec_context.c b/lib/gssapi/ntlm/accept_sec_context.c index 7ba55cd33..a0b3f4ae3 100644 --- a/lib/gssapi/ntlm/accept_sec_context.c +++ b/lib/gssapi/ntlm/accept_sec_context.c @@ -163,12 +163,14 @@ _gss_ntlm_accept_sec_context output_token->value = malloc(out.length); if (output_token->value == NULL && out.length != 0) { OM_uint32 gunk; + heim_ntlm_free_buf(&out); _gss_ntlm_delete_sec_context(&gunk, context_handle, NULL); *minor_status = ENOMEM; return GSS_S_FAILURE; } memcpy(output_token->value, out.data, out.length); output_token->length = out.length; + heim_ntlm_free_buf(&out); ctx->flags = retflags; diff --git a/lib/gssapi/ntlm/kdc.c b/lib/gssapi/ntlm/kdc.c index 06d738206..0c9a56351 100644 --- a/lib/gssapi/ntlm/kdc.c +++ b/lib/gssapi/ntlm/kdc.c @@ -86,7 +86,7 @@ get_ccache(krb5_context context, int *destroy, krb5_ccache *id) ret = krb5_cc_cache_match(context, principal, id); if (ret == 0) - return 0; + goto out; /* did not find in default credcache, lets try default keytab */ ret = krb5_kt_default(context, &kt); diff --git a/lib/gssapi/ntlm/release_cred.c b/lib/gssapi/ntlm/release_cred.c index 49d88a2b2..e31a31611 100644 --- a/lib/gssapi/ntlm/release_cred.c +++ b/lib/gssapi/ntlm/release_cred.c @@ -58,6 +58,9 @@ OM_uint32 GSSAPI_CALLCONV _gss_ntlm_release_cred free(cred->key.data); } + memset(cred, 0, sizeof(*cred)); + free(cred); + return GSS_S_COMPLETE; }
