From 07c10f09a51379b772beeacc14606ae5cf0e0d10 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Thu, 19 Mar 2026 15:47:05 +0100
Subject: [PATCH] tool_operhlp: fix `add_file_name_to_url()` result on OOM

Return `CURLE_OUT_OF_MEMORY` instead of `CURLE_URL_MALFORMAT` when
`curl_url()`, `curl_easy_escape()`, or `curl_maprintf()` calls failed.

Found by Codex Security

Also reuse deinit code from a success branch.

Closes #21011
---
 src/tool_operhlp.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/src/tool_operhlp.c b/src/tool_operhlp.c
index 11c341cb9c..79ddd905f4 100644
--- a/src/tool_operhlp.c
+++ b/src/tool_operhlp.c
@@ -83,7 +83,7 @@ CURLcode urlerr_cvt(CURLUcode ucode)
  */
 CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
 {
-  CURLcode result = CURLE_URL_MALFORMAT;
+  CURLcode result = CURLE_OUT_OF_MEMORY;
   CURLUcode uerr;
   CURLU *uh = curl_url();
   char *path = NULL;
@@ -94,19 +94,18 @@ CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
                         CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME);
     if(uerr) {
       result = urlerr_cvt(uerr);
-      goto fail;
+      goto out;
     }
     uerr = curl_url_get(uh, CURLUPART_PATH, &path, 0);
     if(uerr) {
       result = urlerr_cvt(uerr);
-      goto fail;
+      goto out;
     }
     uerr = curl_url_get(uh, CURLUPART_QUERY, &query, 0);
     if(!uerr && query) {
       curl_free(query);
-      curl_free(path);
-      curl_url_cleanup(uh);
-      return CURLE_OK;
+      result = CURLE_OK;
+      goto out;
     }
     ptr = strrchr(path, '/');
     if(!ptr || !*++ptr) {
@@ -141,17 +140,17 @@ CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
         curl_free(encfile);
 
         if(!newpath)
-          goto fail;
+          goto out;
         uerr = curl_url_set(uh, CURLUPART_PATH, newpath, 0);
         curlx_free(newpath);
         if(uerr) {
           result = urlerr_cvt(uerr);
-          goto fail;
+          goto out;
         }
         uerr = curl_url_get(uh, CURLUPART_URL, &newurl, CURLU_DEFAULT_SCHEME);
         if(uerr) {
           result = urlerr_cvt(uerr);
-          goto fail;
+          goto out;
         }
         curlx_free(*inurlp);
         *inurlp = newurl;
@@ -159,10 +158,9 @@ CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
       }
     }
     else
-      /* nothing to do */
-      result = CURLE_OK;
+      result = CURLE_OK;  /* nothing to do */
   }
-fail:
+out:
   curl_url_cleanup(uh);
   curl_free(path);
   return result;