romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-25 00:22:12 +03:00
Code Issues Projects Releases Packages Wiki Activity

rustls: fix memory leak on repeated SSLKEYLOGFILE fails

Browse source 
Before this fix, Curl_tls_keylog_open() assigned the environment
variable result to a global keylog_file_name without freeing any prior
allocation. If the file cannot be opened (e.g., permission error)
keylog_file_fp stays NULL, so subsequent calls to Curl_tls_keylog_open
will overwrite keylog_file_name and leak the previous allocation.

Spotted by Codex Security

Closes #21427
This commit is contained in:
Daniel Stenberg 2026-04-23 21:49:50 +02:00
parent 734793f533
commit 961a13e366
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/vtls/keylog.c
View file

@ -38,7 +38,7 @@ static char *keylog_file_name;
void Curl_tls_keylog_open(void)
{
if(!keylog_file_fp) {
keylog_file_name = curl_getenv("SSLKEYLOGFILE");
keylog_file_name = getenv("SSLKEYLOGFILE");
if(keylog_file_name) {
keylog_file_fp = curlx_fopen(keylog_file_name, FOPEN_APPENDTEXT);
if(keylog_file_fp) {
@ -62,7 +62,6 @@ void Curl_tls_keylog_close(void)
curlx_fclose(keylog_file_fp);
keylog_file_fp = NULL;
}
curlx_safefree(keylog_file_name);
}
bool Curl_tls_keylog_enabled(void)