diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2022-01-13 14:27:06 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2022-01-13 14:27:06 +0100 |
| commit | 5b964848638de326235643e71ae7b272459f2b36 (patch) | |
| tree | b88c49fe72b66f7982ff9d1b20044ca1b2df3fdd | |
| parent | c07a71e74f3d0ec8ff940bc56ed8cfb06884532e (diff) | |
| download | curl-bagder/mqtt-done.tar.gz | |
mqtt: free any leftover when donebagder/mqtt-done
Oss-fuzz found an issue when the "sendleftovers" pointer could leak memory.
Fix this by always freeing it (if still assigned) in the done function.
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43515
| -rw-r--r-- | lib/mqtt.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/lib/mqtt.c b/lib/mqtt.c index fcd40b41e..c056ae77b 100644 --- a/lib/mqtt.c +++ b/lib/mqtt.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 2020 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 2020 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al. * Copyright (C) 2019, Björn Stenberg, <bjorn@haxx.se> * * This software is licensed as described in the file COPYING, which @@ -60,6 +60,8 @@ */ static CURLcode mqtt_do(struct Curl_easy *data, bool *done); +static CURLcode mqtt_done(struct Curl_easy *data, + CURLcode status, bool premature); static CURLcode mqtt_doing(struct Curl_easy *data, bool *done); static int mqtt_getsock(struct Curl_easy *data, struct connectdata *conn, curl_socket_t *sock); @@ -74,7 +76,7 @@ const struct Curl_handler Curl_handler_mqtt = { "MQTT", /* scheme */ mqtt_setup_conn, /* setup_connection */ mqtt_do, /* do_it */ - ZERO_NULL, /* done */ + mqtt_done, /* done */ ZERO_NULL, /* do_more */ ZERO_NULL, /* connect_it */ ZERO_NULL, /* connecting */ @@ -692,6 +694,16 @@ static CURLcode mqtt_do(struct Curl_easy *data, bool *done) return CURLE_OK; } +static CURLcode mqtt_done(struct Curl_easy *data, + CURLcode status, bool premature) +{ + struct MQTT *mq = data->req.p.mqtt; + (void)status; + (void)premature; + Curl_safefree(mq->sendleftovers); + return CURLE_OK; +} + static CURLcode mqtt_doing(struct Curl_easy *data, bool *done) { CURLcode result = CURLE_OK; |