From 1098e1044e6aadb471999c88bd184132c3ebc3d8 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 17 Mar 2026 13:30:02 +0100
Subject: [PATCH] tool_urlglob: fix memory-leak on glob range overflow

Follow-up to 5f273fdddf76544de960b

Pointed out by Codex Security

Closes #20956
---
 src/tool_urlglob.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c
index cec6f09efe..d32d10d167 100644
--- a/src/tool_urlglob.c
+++ b/src/tool_urlglob.c
@@ -130,8 +130,10 @@ static CURLcode glob_set(struct URLGlob *glob, const char **patternp,
       done = TRUE;
       FALLTHROUGH();
     case ',':
-      if(size >= 100000)
-        return globerror(glob, "range overflow", 0, CURLE_URL_MALFORMAT);
+      if(size >= 100000) {
+        result = globerror(glob, "range overflow", 0, CURLE_URL_MALFORMAT);
+        goto error;
+      }
 
       if(!palloc) {
         palloc = 5; /* a reasonable default */