David Byron found a problem multiple -d options when libcurl was built with

--enable-debug, as then curl used free() on memory allocated both with
normal malloc() and with libcurl-provided functions, when the latter MUST be
freed with curl_free() in debug builds.

1 files changed, 5 insertions, 1 deletions

diff --git a/src/main.c b/src/main.c
index 0e1935670..10aafd81c 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1892,7 +1892,11 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */
           /* we already have a string, we append this one
              with a separating &-letter */
           char *oldpost=config->postfields;
-          config->postfields=aprintf("%s&%s", oldpost, postdata);
+          size_t newlen = strlen(oldpost) + strlen(postdata) + 2;
+          config->postfields=malloc(newlen);
+          if(!config->postfields)
+            return PARAM_NO_MEM;
+          snprintf(config->postfields, newlen, "%s&%s", oldpost, postdata);
           free(oldpost);
           free(postdata);
         }