moparisthebest
/
curl
mirror of https://github.com/moparisthebest/curl
1
0
Fork 0
Code Issues Releases Wiki Activity

smtp: Fixed inappropriate free of the scratch buffer 

If the scratch buffer was allocated in a previous call to
Curl_smtp_escape_eob(), a new buffer not allocated in the subsequent
call and no action taken by that call, then an attempt would be made to
try and free the buffer which, by now, would be part of the data->state
structure.

This bug was introduced in commit 4bd860a001.
This commit is contained in:
Steve Holme 2014-12-12 18:55:16 +00:00
parent f0ecdd04d3
commit 8a4ce7d0f5
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/smtp.c
View File

@ -2321,6 +2321,7 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)
struct SessionHandle *data = conn->data;
struct SMTP *smtp = data->req.protop;
char *scratch = data->state.scratch;
char *newscratch = NULL;
char *oldscratch = NULL;
size_t eob_sent;
@ -2328,8 +2329,8 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)
if(!scratch || data->set.crlf) {
oldscratch = scratch;
scratch = malloc(2 * BUFSIZE);
if(!scratch) {
scratch = newscratch = malloc(2 * BUFSIZE);
if(!newscratch) {
failf(data, "Failed to alloc scratch buffer!");
return CURLE_OUT_OF_MEMORY;
@ -2401,7 +2402,7 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)
data->req.upload_present = si;
}
else
Curl_safefree(scratch);
Curl_safefree(newscratch);
return CURLE_OK;
}