Fixes some more out of memory handling bugs.

4 files changed, 9 insertions, 1 deletions

diff --git a/lib/base64.c b/lib/base64.c
index d78ba663e..5669e4c1d 100644
--- a/lib/base64.c
+++ b/lib/base64.c
@@ -173,11 +173,13 @@ size_t Curl_base64_encode(struct SessionHandle *data,
   if(data) {
     convbuf = (char*)malloc(insize);
     if(!convbuf) {
+      free(output);
       return 0;
     }
     memcpy(convbuf, indata, insize);
     if(CURLE_OK != Curl_convert_to_network(data, convbuf, insize)) {
       free(convbuf);
+      free(output);
       return 0;
     }
     indata = convbuf; /* switch to the converted buffer */
diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c
index bdfeefa0a..ac93413cf 100644
--- a/lib/http_negotiate.c
+++ b/lib/http_negotiate.c
@@ -295,7 +295,7 @@ CURLcode Curl_output_negotiate(struct connectdata *conn)
                            neg_ctx->output_token.length,
                            &encoded);
 
-  if (len < 0)
+  if (len == 0)
     return CURLE_OUT_OF_MEMORY;
 
   conn->allocptr.userpwd =
diff --git a/lib/http_ntlm.c b/lib/http_ntlm.c
index cc307f72d..b4df726b5 100644
--- a/lib/http_ntlm.c
+++ b/lib/http_ntlm.c
@@ -421,6 +421,10 @@ static void mk_nt_hash(struct SessionHandle *data,
 {
   size_t len = strlen(password);
   unsigned char *pw = malloc(len*2);
+  if (!pw)
+    /* No way to report this error; just rely on future malloc failures
+       to be caught */
+    return;
 
   utf8_to_unicode_le(pw, password, len);
 
diff --git a/lib/url.c b/lib/url.c
index 0ae0197d3..edbd1157c 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -2856,6 +2856,8 @@ static CURLcode CreateConnection(struct SessionHandle *data,
   /* Initialize the pipeline lists */
   conn->send_pipe = Curl_llist_alloc((curl_llist_dtor) llist_dtor);
   conn->recv_pipe = Curl_llist_alloc((curl_llist_dtor) llist_dtor);
+  if (!conn->send_pipe || !conn->recv_pipe)
+    return CURLE_OUT_OF_MEMORY;
 
   /* Store creation time to help future close decision making */
   conn->created = Curl_tvnow();