summaryrefslogtreecommitdiff
path: root/lib/http2.c
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2018-09-25 11:48:43 +0200
committerDaniel Stenberg <daniel@haxx.se>2018-09-25 17:03:45 +0200
commit304bb2f7c1b463373aa31c1530144c67f6afddb2 (patch)
tree40f4695836f14ace7d589df0ede10a695d0bd62b /lib/http2.c
parent4058cf2a7f7e2590c26588c4eb476ac5c029cb5a (diff)
downloadcurl-304bb2f7c1b463373aa31c1530144c67f6afddb2.tar.gz
Curl_http2_done: fix memleak in error path
Free 'header_recvbuf' unconditionally even if 'h2' isn't (yet) set, for early failures. Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10669 Closes #3046
Diffstat (limited to 'lib/http2.c')
-rw-r--r--lib/http2.c14
1 files changed, 8 insertions, 6 deletions
diff --git a/lib/http2.c b/lib/http2.c
index b1a8213bd..29edfba7a 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1142,12 +1142,8 @@ void Curl_http2_done(struct connectdata *conn, bool premature)
struct HTTP *http = data->req.protop;
struct http_conn *httpc = &conn->proto.httpc;
- if(!httpc->h2) /* not HTTP/2 ? */
- return;
-
- if(data->state.drain)
- drained_transfer(data, httpc);
-
+ /* there might be allocated resources done before this got the 'h2' pointer
+ setup */
if(http->header_recvbuf) {
Curl_add_buffer_free(&http->header_recvbuf);
Curl_add_buffer_free(&http->trailer_recvbuf);
@@ -1161,6 +1157,12 @@ void Curl_http2_done(struct connectdata *conn, bool premature)
}
}
+ if(!httpc->h2) /* not HTTP/2 ? */
+ return;
+
+ if(data->state.drain)
+ drained_transfer(data, httpc);
+
if(premature) {
/* RST_STREAM */
if(!nghttp2_submit_rst_stream(httpc->h2, NGHTTP2_FLAG_NONE,