Fixes some more out of memory handling bugs.

lib/base64.c

@@ -173,11 +173,13 @@ size_t Curl_base64_encode(struct SessionHandle *data,
   if(data) {
     convbuf = (char*)malloc(insize);
     if(!convbuf) {
+      free(output);
       return 0;
     }
     memcpy(convbuf, indata, insize);
     if(CURLE_OK != Curl_convert_to_network(data, convbuf, insize)) {
       free(convbuf);
+      free(output);
       return 0;
     }
     indata = convbuf; /* switch to the converted buffer */

lib/http_negotiate.c

@@ -295,7 +295,7 @@ CURLcode Curl_output_negotiate(struct connectdata *conn)
                            neg_ctx->output_token.length,
                            &encoded);
 
-  if (len < 0)
+  if (len == 0)
     return CURLE_OUT_OF_MEMORY;
 
   conn->allocptr.userpwd =

lib/http_ntlm.c

@@ -421,6 +421,10 @@ static void mk_nt_hash(struct SessionHandle *data,
 {
   size_t len = strlen(password);
   unsigned char *pw = malloc(len*2);
+  if (!pw)
+    /* No way to report this error; just rely on future malloc failures
+       to be caught */
+    return;
 
   utf8_to_unicode_le(pw, password, len);
 

lib/url.c

@@ -2856,6 +2856,8 @@ static CURLcode CreateConnection(struct SessionHandle *data,
   /* Initialize the pipeline lists */
   conn->send_pipe = Curl_llist_alloc((curl_llist_dtor) llist_dtor);
   conn->recv_pipe = Curl_llist_alloc((curl_llist_dtor) llist_dtor);
+  if (!conn->send_pipe || !conn->recv_pipe)
+    return CURLE_OUT_OF_MEMORY;
 
   /* Store creation time to help future close decision making */
   conn->created = Curl_tvnow();