romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-01 20:50:27 +03:00
Code Issues Projects Releases Packages Wiki Activity

var: use a dedicated pointer for the alloc

Browse source 
As the 'c' pointer might actually get modified before it is time to free
the memory.

Verify in test 2310

Reported-by: Eunsoo Kim
Fixes #21898
Closes #21900
This commit is contained in:
Daniel Stenberg 2026-06-08 08:11:34 +02:00
parent 0618ffe50d
commit 9b69cfb937
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 57 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/var.c
View file

@ -78,7 +78,7 @@ static ParameterError varfunc(char *c, /* content */
size_t flen, /* function string length */
struct dynbuf *out)
{
bool alloc = FALSE;
char *allocptr = NULL;
ParameterError err = PARAM_OK;
const char *finput = f;
@ -185,19 +185,18 @@ static ParameterError varfunc(char *c, /* content */
err = PARAM_EXPAND_ERROR;
break;
}
if(alloc)
curlx_free(c);
if(allocptr)
curlx_free(allocptr);
clen = curlx_dyn_len(out);
c = curlx_memdup0(curlx_dyn_ptr(out), clen);
allocptr = c = curlx_memdup0(curlx_dyn_ptr(out), clen);
if(!c) {
err = PARAM_NO_MEM;
break;
}
alloc = TRUE;
}
if(alloc)
curlx_free(c);
if(allocptr)
curlx_free(allocptr);
if(err)
curlx_dyn_free(out);
return err;