diff options
| author | Emil Lerner <neex.emil@gmail.com> | 2016-02-19 03:47:27 +0300 |
|---|---|---|
| committer | Jay Satiro <raysatiro@yahoo.com> | 2016-02-19 21:52:05 -0500 |
| commit | 3fa220a6a5a3f3e9db89b04845ac5a8367445952 (patch) | |
| tree | ca49a38d8c9f276e6295de1f2c8e023aa94efc4e /lib/curl_sasl.c | |
| parent | fe37695aa9a1fe06b9cd119ea6f48f4fb324c4b0 (diff) | |
curl_sasl: Fix memory leak in digest parser
If any parameter in a HTTP DIGEST challenge message is present multiple
times, memory allocated for all but the last entry should be freed.
Bug: https://github.com/curl/curl/pull/667
Diffstat (limited to 'lib/curl_sasl.c')
| -rw-r--r-- | lib/curl_sasl.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c index f6677ece7..ef6283c5a 100644 --- a/lib/curl_sasl.c +++ b/lib/curl_sasl.c @@ -782,6 +782,7 @@ CURLcode Curl_sasl_decode_digest_http_message(const char *chlg, /* Extract a value=content pair */ if(!Curl_sasl_digest_get_pair(chlg, value, content, &chlg)) { if(Curl_raw_equal(value, "nonce")) { + free(digest->nonce); digest->nonce = strdup(content); if(!digest->nonce) return CURLE_OUT_OF_MEMORY; @@ -793,11 +794,13 @@ CURLcode Curl_sasl_decode_digest_http_message(const char *chlg, } } else if(Curl_raw_equal(value, "realm")) { + free(digest->realm); digest->realm = strdup(content); if(!digest->realm) return CURLE_OUT_OF_MEMORY; } else if(Curl_raw_equal(value, "opaque")) { + free(digest->opaque); digest->opaque = strdup(content); if(!digest->opaque) return CURLE_OUT_OF_MEMORY; @@ -825,17 +828,20 @@ CURLcode Curl_sasl_decode_digest_http_message(const char *chlg, /* Select only auth or auth-int. Otherwise, ignore */ if(foundAuth) { + free(digest->qop); digest->qop = strdup(DIGEST_QOP_VALUE_STRING_AUTH); if(!digest->qop) return CURLE_OUT_OF_MEMORY; } else if(foundAuthInt) { + free(digest->qop); digest->qop = strdup(DIGEST_QOP_VALUE_STRING_AUTH_INT); if(!digest->qop) return CURLE_OUT_OF_MEMORY; } } else if(Curl_raw_equal(value, "algorithm")) { + free(digest->algorithm); digest->algorithm = strdup(content); if(!digest->algorithm) return CURLE_OUT_OF_MEMORY; |