diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2019-09-05 00:08:21 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2019-09-09 09:36:27 +0200 |
| commit | c4c9e070f35c113b8b9c4d79ca1b9c1afe87d0e4 (patch) | |
| tree | 912b7e417bcbd50547567bdfeface0f2d2c2f8cc /lib/transfer.c | |
| parent | 74e152f11915cdd46792daf5c5728be1b0dd9503 (diff) | |
Curl_fillreadbuffer: avoid double-free trailer buf on error
Reviewed-by: Jay Satiro
Reported-by: Thomas Vegas
Closes #4307
Diffstat (limited to 'lib/transfer.c')
| -rw-r--r-- | lib/transfer.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/lib/transfer.c b/lib/transfer.c index 7e57fbe03..ef0d80638 100644 --- a/lib/transfer.c +++ b/lib/transfer.c @@ -176,7 +176,7 @@ CURLcode Curl_fillreadbuffer(struct connectdata *conn, size_t bytes, #ifndef CURL_DISABLE_HTTP if(data->state.trailers_state == TRAILERS_INITIALIZED) { struct curl_slist *trailers = NULL; - CURLcode c; + CURLcode result; int trailers_ret_code; /* at this point we already verified that the callback exists @@ -195,17 +195,18 @@ CURLcode Curl_fillreadbuffer(struct connectdata *conn, size_t bytes, data->set.trailer_data); Curl_set_in_callback(data, false); if(trailers_ret_code == CURL_TRAILERFUNC_OK) { - c = Curl_http_compile_trailers(trailers, data->state.trailers_buf, data); + result = Curl_http_compile_trailers(trailers, &data->state.trailers_buf, + data); } else { failf(data, "operation aborted by trailing headers callback"); *nreadp = 0; - c = CURLE_ABORTED_BY_CALLBACK; + result = CURLE_ABORTED_BY_CALLBACK; } - if(c != CURLE_OK) { + if(result) { Curl_add_buffer_free(&data->state.trailers_buf); curl_slist_free_all(trailers); - return c; + return result; } infof(data, "Successfully compiled trailers.\r\n"); curl_slist_free_all(trailers); |