=== src/lib/krb5/krb/ChangeLog
==================================================================
--- src/lib/krb5/krb/ChangeLog  (revision 1274)
+++ src/lib/krb5/krb/ChangeLog  (local)
@@ -1,3 +1,9 @@
+2005-11-17  Jeffrey Altman <jaltman@mit.edu>
+
+       * gc_frm_kdc.c (krb5_get_cred_from_kdc_opt):
+         properly track the state of 'tgt' via 'free_tgt' so that
+          we can avoid double-free'ing memory when we return to
+          krb5_get_credentials().
 2005-09-22  Tom Yu  <tlyu@mit.edu>
 
 	* mk_req_ext.c (krb5int_generate_and_save_subkey): Check for and
=== src/lib/krb5/krb/gc_frm_kdc.c
==================================================================
--- src/lib/krb5/krb/gc_frm_kdc.c  (revision 1274)
+++ src/lib/krb5/krb/gc_frm_kdc.c  (local)
@@ -251,7 +251,6 @@
 		/* Copy back in case invalided */
 		tgt = otgt;
 		free_otgt = 0;
-		free_tgt = 1;
 		if (!krb5_c_valid_enctype(tgt.keyblock.enctype)) {
 		    retval = KRB5_PROG_ETYPE_NOSUPP;
 		    goto cleanup;
@@ -325,7 +324,6 @@
   
 			    tgt = otgt;
 			    free_otgt = 0;
-			    free_tgt = 1;
 			    if (!krb5_c_valid_enctype(tgt.keyblock.enctype)) {
 				retval = KRB5_PROG_ETYPE_NOSUPP;
 				goto cleanup;
@@ -365,6 +363,7 @@
 			    }
 	      
 			    tgt = *ret_tgts[ntgts++];
+                           free_tgt = 0;
 			} 
           
 			/* got one as close as possible, now start all over */
@@ -413,12 +412,11 @@
 		krb5_free_creds(context, tgtr);
 		tgtr = NULL;
 
-		if (free_tgt) {
+               if (free_tgt)
 		    krb5_free_cred_contents(context, &tgt);
-		    free_tgt = 0;
-		}
 
 		tgt = *ret_tgts[ntgts++];
+               free_tgt = 0;
 
 		/* we're done if it is the target */
 
