David Byron found a problem multiple -d options when libcurl was built with

--enable-debug, as then curl used free() on memory allocated both with
normal malloc() and with libcurl-provided functions, when the latter MUST be
freed with curl_free() in debug builds.

3 files changed, 14 insertions, 2 deletions

diff --git a/CHANGES b/CHANGES
index 660229884..62296efa0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,12 @@
 
                                   Changelog
 
+Daniel (27 March 2006)
+- David Byron found a problem multiple -d options when libcurl was built with
+  --enable-debug, as then curl used free() on memory allocated both with
+  normal malloc() and with libcurl-provided functions, when the latter MUST be
+  freed with curl_free() in debug builds.
+
 Daniel (26 March 2006)
 - Tor Arntsen figured out that TFTP was broken on a lot of systems since we
   called bind() with a too big argument in the 3rd parameter and at least
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index aad60791d..73d5165b0 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -16,6 +16,7 @@ This release includes the following changes:
 
 This release includes the following bugfixes:
 
+ o fixed debug build crash with -d
  o TFTP works on more systems
  o generates a fine AIX Toolbox RPM spec
  o treat FTP AUTH failures properly
@@ -29,6 +30,7 @@ Other curl-related news since the previous public release:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
- Dan Fandrich, Ilja van Sprundel, David McCreedy, Tor Arntsen, Xavier Bouchoux
+ Dan Fandrich, Ilja van Sprundel, David McCreedy, Tor Arntsen, Xavier Bouchoux,
+ David Byron
 
         Thanks! (and sorry if I forgot to mention someone)
diff --git a/src/main.c b/src/main.c
index 0e1935670..10aafd81c 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1892,7 +1892,11 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */
           /* we already have a string, we append this one
              with a separating &-letter */
           char *oldpost=config->postfields;
-          config->postfields=aprintf("%s&%s", oldpost, postdata);
+          size_t newlen = strlen(oldpost) + strlen(postdata) + 2;
+          config->postfields=malloc(newlen);
+          if(!config->postfields)
+            return PARAM_NO_MEM;
+          snprintf(config->postfields, newlen, "%s&%s", oldpost, postdata);
           free(oldpost);
           free(postdata);
         }