ddb22d12c2 — curl

Subject

lib5004: fix memleak on OOM, check all slist append results (httpsig)

No binary (build failed)

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

(log yok)

.github/workflows/linux.yml+2 -2

@@ -296,13 +296,13 @@ jobs:
	install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
	tflags: '-t --shallow=25 --min=960 1 to 1000'
	torture: true
-	generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON
+	generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF

	- name: 'openssl torture 2'
	install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
	tflags: '-t --shallow=25 --min=915 1001 to 9999'
	torture: true
-	generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON
+	generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF

	- name: 'openssl i686'
	install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 libssh2-1-dev:i386 libidn2-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386

tests/libtest/lib5000.c+3 -1

@@ -50,7 +50,9 @@ static CURLcode test_lib5000(const char *URL)
	easy_setopt(curl, CURLOPT_HEADER, 0L);
	easy_setopt(curl, CURLOPT_URL, URL);
	if(libtest_arg2) {
-	connect_to = curl_slist_append(connect_to, libtest_arg2);
+	connect_to = curl_slist_append(NULL, libtest_arg2);
+	if(!connect_to)
+	goto test_cleanup;
	}
	easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);

tests/libtest/lib5004.c+18 -7

@@ -34,6 +34,7 @@ static CURLcode test_lib5004(const char *URL)
	CURLcode result = TEST_ERR_MAJOR_BAD;
	struct curl_slist *connect_to = NULL;
	struct curl_slist *headers = NULL;
+	struct curl_slist *nheaders;

	if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
	curl_mfprintf(stderr, "curl_global_init() failed\n");
@@ -57,18 +58,28 @@ static CURLcode test_lib5004(const char *URL)
	"date: method path authority content-type: content-length:");
	easy_setopt(curl, CURLOPT_POSTFIELDS, "{\"hello\": \"world\"}");

-	headers = curl_slist_append(headers,
-	"Date: Tue, 20 Apr 2021 02:07:55 GMT");
-	headers = curl_slist_append(headers,
-	"Content-Type: application/json");
-	headers = curl_slist_append(headers,
-	"Content-Length: 18");
+	headers = curl_slist_append(NULL, "Date: Tue, 20 Apr 2021 02:07:55 GMT");
+	if(!headers)
+	goto test_cleanup;
+
+	nheaders = curl_slist_append(headers, "Content-Type: application/json");
+	if(!nheaders)
+	goto test_cleanup;
+	headers = nheaders;
+
+	nheaders = curl_slist_append(headers, "Content-Length: 18");
+	if(!nheaders)
+	goto test_cleanup;
+	headers = nheaders;
+
	easy_setopt(curl, CURLOPT_HTTPHEADER, headers);

	easy_setopt(curl, CURLOPT_HEADER, 0L);
	easy_setopt(curl, CURLOPT_URL, URL);
	if(libtest_arg2) {
-	connect_to = curl_slist_append(connect_to, libtest_arg2);
+	connect_to = curl_slist_append(NULL, libtest_arg2);
+	if(!connect_to)
+	goto test_cleanup;
	}
	easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);