diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2017-10-10 14:34:57 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2017-10-10 22:56:50 +0200 |
| commit | 38ab7b4ccb18f03c0323d412ff0f3613cd66f5e5 (patch) | |
| tree | b3feff493e4d2f36e4ea343698685cfd9fafe013 | |
| parent | ecf21c551fa3426579463abe34b623111b8d487c (diff) | |
smtp_done: free data before returning (on send failure)
... as otherwise it could leak that memory.
Detected by OSS-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3600
Assisted-by: Max Dymond
Closes #1977
| -rw-r--r-- | lib/smtp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/smtp.c b/lib/smtp.c index de2dd3356..08d8148a3 100644 --- a/lib/smtp.c +++ b/lib/smtp.c @@ -1188,6 +1188,9 @@ static CURLcode smtp_done(struct connectdata *conn, CURLcode status, if(!smtp || !pp->conn) return CURLE_OK; + /* Cleanup our per-request based variables */ + Curl_safefree(smtp->custom); + if(status) { connclose(conn, "SMTP done with bad status"); /* marked for closure */ result = status; /* use the already set error code */ @@ -1246,9 +1249,6 @@ static CURLcode smtp_done(struct connectdata *conn, CURLcode status, result = smtp_block_statemach(conn); } - /* Cleanup our per-request based variables */ - Curl_safefree(smtp->custom); - /* Clear the transfer mode for the next request */ smtp->transfer = FTPTRANSFER_BODY; |