From 6afe70a00bb4018810d8f4417bc49b44a7998e46 Mon Sep 17 00:00:00 2001
From: Michael Kaufmann <mail@michael-kaufmann.ch>
Date: Wed, 10 Oct 2018 22:53:50 +0200
Subject: [PATCH] Curl_follow: Always free the passed new URL

Closes #3124
---
 lib/multi.c    | 1 +
 lib/transfer.c | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/multi.c b/lib/multi.c
index 9a98435e6..acf9ecc6e 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -1725,6 +1725,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
             if(!drc || (drc == CURLE_SEND_ERROR)) {
               follow = FOLLOW_RETRY;
               drc = Curl_follow(data, newurl, follow);
+              newurl = NULL; /* freed by Curl_follow() */
               if(!drc) {
                 multistate(data, CURLM_STATE_CONNECT);
                 rc = CURLM_CALL_MULTI_PERFORM;
diff --git a/lib/transfer.c b/lib/transfer.c
index 638ae9ec5..2a348b687 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1500,8 +1500,10 @@ CURLcode Curl_follow(struct Curl_easy *data,
         }
 
         data->change.referer = strdup(data->change.url);
-        if(!data->change.referer)
+        if(!data->change.referer) {
+          free(newurl);
           return CURLE_OUT_OF_MEMORY;
+        }
         data->change.referer_alloc = TRUE; /* yes, free this later */
       }
     }