diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2018-10-02 09:58:04 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2018-10-19 15:29:31 +0200 |
| commit | 05564e750e8f0c79016c680f301ce251e6e86155 (patch) | |
| tree | b875de08e14b604feb07175c44b09165722a4c03 /lib/transfer.c | |
| parent | 8a49f91d328f86e02f841aee3f0f8ae200b39131 (diff) | |
multi: avoid double-free
Curl_follow() no longer frees the string. Make sure it happens in the
caller function, like we normally handle allocations.
This bug was introduced with the use of the URL API internally, it has
never been in a release version
Reported-by: Dario Weißer
Closes #3149
Diffstat (limited to 'lib/transfer.c')
| -rw-r--r-- | lib/transfer.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/transfer.c b/lib/transfer.c index 2a348b687..deb0ec786 100644 --- a/lib/transfer.c +++ b/lib/transfer.c @@ -1458,6 +1458,8 @@ CURLcode Curl_posttransfer(struct Curl_easy *data) /* * Curl_follow() handles the URL redirect magic. Pass in the 'newurl' string * as given by the remote server and set up the new URL to request. + * + * This function DOES NOT FREE the given url. */ CURLcode Curl_follow(struct Curl_easy *data, char *newurl, /* the Location: string */ @@ -1515,7 +1517,6 @@ CURLcode Curl_follow(struct Curl_easy *data, DEBUGASSERT(data->state.uh); uc = curl_url_set(data->state.uh, CURLUPART_URL, newurl, 0); - free(newurl); if(uc) /* TODO: consider an error code remap here */ return CURLE_URL_MALFORMAT; |