Commit 9c1cf966 authored by Marcel Raad's avatar Marcel Raad Committed by Daniel Stenberg
Browse files

SSPI Negotiate: Fix 3 memory leaks 

Curl_base64_decode allocates the output string by itself and two other
strings were not freed either.
parent 821d4a1e

lib/http_negotiate_sspi.c

+7 −6
Original line number Diff line number Diff line
@@ -136,10 +136,6 @@ int Curl_input_negotiate(struct connectdata *conn, bool proxy, 
      return -1;

  }

  else {

    input_token = malloc(neg_ctx->max_token_length);

    if(!input_token)

      return -1;



    error = Curl_base64_decode(header,

                               (unsigned char **)&input_token,

                               &input_token_len);
@@ -186,6 +182,7 @@ int Curl_input_negotiate(struct connectdata *conn, bool proxy, 
    &lifetime);



  Curl_unicodefree(sname);

  Curl_safefree(input_token);



  if(GSS_ERROR(neg_ctx->status))

    return -1;
@@ -226,10 +223,14 @@ CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy) 
  userp = aprintf("%sAuthorization: Negotiate %s\r\n", proxy ? "Proxy-" : "",

                  encoded);



  if(proxy)

  if(proxy) {

    Curl_safefree(conn->allocptr.proxyuserpwd);

    conn->allocptr.proxyuserpwd = userp;

  else

  }

  else {

    Curl_safefree(conn->allocptr.userpwd);

    conn->allocptr.userpwd = userp;

  }

  free(encoded);

  return (userp == NULL) ? CURLE_OUT_OF_MEMORY : CURLE_OK;

}