Fixed some out of memory handling issues.

lib/ftp.c

@@ -3647,7 +3647,6 @@ CURLcode Curl_ftp_disconnect(struct connectdata *conn)
 static
 CURLcode ftp_parse_url_path(struct connectdata *conn)
 {
-  CURLcode retcode = CURLE_OK;
   struct SessionHandle *data = conn->data;
   /* the ftp struct is already inited in ftp_connect() */
   struct FTP *ftp = data->reqdata.proto.ftp;
@@ -3720,6 +3719,7 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
           return CURLE_OUT_OF_MEMORY;
         }
         if (isBadFtpString(ftpc->dirs[ftpc->dirdepth])) {
+          free(ftpc->dirs[ftpc->dirdepth]);
           freedirs(conn);
           return CURLE_URL_MALFORMAT;
         }
@@ -3729,20 +3729,17 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
         continue;
       }
 
-      if(!retcode) {
-        cur_pos = slash_pos + 1; /* jump to the rest of the string */
-        if(++ftpc->dirdepth >= ftpc->diralloc) {
-          /* enlarge array */
-          char *bigger;
-          ftpc->diralloc *= 2; /* double the size each time */
-          bigger = realloc(ftpc->dirs, ftpc->diralloc * sizeof(ftpc->dirs[0]));
-          if(!bigger) {
-            ftpc->dirdepth--;
-            freedirs(conn);
-            return CURLE_OUT_OF_MEMORY;
-          }
-          ftpc->dirs = (char **)bigger;
-        }
+      cur_pos = slash_pos + 1; /* jump to the rest of the string */
+      if(++ftpc->dirdepth >= ftpc->diralloc) {
+	/* enlarge array */
+	char *bigger;
+	ftpc->diralloc *= 2; /* double the size each time */
+	bigger = realloc(ftpc->dirs, ftpc->diralloc * sizeof(ftpc->dirs[0]));
+	if(!bigger) {
+	  freedirs(conn);
+	  return CURLE_OUT_OF_MEMORY;
+	}
+	ftpc->dirs = (char **)bigger;
       }
     }
 
@@ -3790,7 +3787,7 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
     free(path);
   }
 
-  return retcode;
+  return CURLE_OK;
 }
 
 /* call this when the DO phase has completed */

lib/tftp.c

@@ -286,6 +286,9 @@ static CURLcode tftp_send_first(tftp_state_data_t *state, tftp_event_t event)
     file name so we skip the always-present first letter of the path string. */
     filename = curl_easy_unescape(data, &state->conn->data->reqdata.path[1], 0,
                                   NULL);
+    if (!filename)
+      return CURLE_OUT_OF_MEMORY;
+
     snprintf((char *)&state->spacket.data[2],
              TFTP_BLOCKSIZE,
              "%s%c%s%c", filename, '\0',  mode, '\0');
@@ -673,9 +676,9 @@ CURLcode Curl_tftp(struct connectdata *conn, bool *done)
   }
 
   /* Run the TFTP State Machine */
-  for(tftp_state_machine(state, TFTP_EVENT_INIT);
-      state->state != TFTP_STATE_FIN;
-      tftp_state_machine(state, event) ) {
+  for(code=tftp_state_machine(state, TFTP_EVENT_INIT);
+      (state->state != TFTP_STATE_FIN) && (code == CURLE_OK);
+      code=tftp_state_machine(state, event) ) {
 
     /* Wait until ready to read or timeout occurs */
     rc=Curl_socket_ready(state->sockfd, CURL_SOCKET_BAD, state->retry_time * 1000);
@@ -761,6 +764,8 @@ CURLcode Curl_tftp(struct connectdata *conn, bool *done)
     }
 
   }
+  if(code)
+    return code;
 
   /* Tell curl we're done */
   code = Curl_setup_transfer(conn, -1, -1, FALSE, NULL, -1, NULL);