diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2017-10-10 14:34:57 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2017-10-10 14:38:20 +0200 |
| commit | c60599f7863ff5a16c67a95b38617f4d47eee9ef (patch) | |
| tree | dc088b0fe72529a3633d98c27aa0fcdf537b1a64 | |
| parent | 00fb811e2b05ed88d4847c0a96a7dddb51e77bcf (diff) | |
| download | curl-bagder/smtp-done-free-before-return.tar.gz | |
smtp_done: free data before returning (on send failure)bagder/smtp-done-free-before-return
... as otherwise it could leak that memory.
Detected by OSS-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3600
Assisted-by: Max Dymond
| -rw-r--r-- | lib/smtp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/smtp.c b/lib/smtp.c index de2dd3356..08d8148a3 100644 --- a/lib/smtp.c +++ b/lib/smtp.c @@ -1188,6 +1188,9 @@ static CURLcode smtp_done(struct connectdata *conn, CURLcode status, if(!smtp || !pp->conn) return CURLE_OK; + /* Cleanup our per-request based variables */ + Curl_safefree(smtp->custom); + if(status) { connclose(conn, "SMTP done with bad status"); /* marked for closure */ result = status; /* use the already set error code */ @@ -1246,9 +1249,6 @@ static CURLcode smtp_done(struct connectdata *conn, CURLcode status, result = smtp_block_statemach(conn); } - /* Cleanup our per-request based variables */ - Curl_safefree(smtp->custom); - /* Clear the transfer mode for the next request */ smtp->transfer = FTPTRANSFER_BODY; |