From 64f746ee1e71f1079424cc173b7ec9d93adbb169 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Wed, 29 Jul 2026 17:09:06 +0200
Subject: [PATCH] urlapi: clear password buffer on error path

Reported by Copilot
Bug: https://github.com/curl/curl/pull/21637#pullrequestreview-4809702512
Follow-up to 112a8b5adf36c17e7816a8db701b3e7a22958e52 #21637
Follow-up to 7c34365ccea19949317878c7fcd5f7376e2e09f1 #21879

Closes #22432
---
 lib/urlapi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/urlapi.c b/lib/urlapi.c
index b4dfdda678..1e61fbcae5 100644
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -347,6 +347,7 @@ out:
   curlx_free(passwdp);
   curlx_free(optionsp);
   curlx_safefree(u->user);
+  curlx_strzero(u->password);
   curlx_safefree(u->password);
   curlx_safefree(u->options);