Skip to content

tlv: do not leak on allocation failure in curl_slist_append #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 9, 2023
Merged

tlv: do not leak on allocation failure in curl_slist_append #74

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
28bd29a
tlv: do not leak on allocation failure in curl_slist_append
catenacyber Mar 7, 2023
07f096e
fixup! tlv: do not leak on allocation failure in curl_slist_append
catenacyber Mar 7, 2023
bf88eb6
fixup! fixup! tlv: do not leak on allocation failure in curl_slist_ap…
catenacyber Mar 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions curl_fuzzer_tlv.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ int fuzz_parse_tlv(FUZZ_DATA *fuzz, TLV *tlv)
int rc;
char *tmp = NULL;
uint32_t tmp_u32;
curl_slist *new_list;

switch(tlv->type) {
/* The pointers in response TLVs will always be valid as long as the fuzz
Expand Down Expand Up @@ -143,14 +144,28 @@ int fuzz_parse_tlv(FUZZ_DATA *fuzz, TLV *tlv)
}

tmp = fuzz_tlv_to_string(tlv);
fuzz->header_list = curl_slist_append(fuzz->header_list, tmp);
if (tmp == NULL) {
// keep on despite allocation failure
break;
}
new_list = curl_slist_append(fuzz->header_list, tmp);
if (new_list == NULL) {
break;
}
fuzz->header_list = new_list;
fuzz->header_list_count++;
break;

case TLV_TYPE_MAIL_RECIPIENT:
tmp = fuzz_tlv_to_string(tlv);
fuzz->mail_recipients_list =
curl_slist_append(fuzz->mail_recipients_list, tmp);
if (tmp == NULL) {
// keep on despite allocation failure
break;
}
new_list = curl_slist_append(fuzz->mail_recipients_list, tmp);
if (new_list != NULL) {
fuzz->mail_recipients_list = new_list;
}
break;

case TLV_TYPE_MIME_PART:
Expand Down Expand Up @@ -255,6 +270,9 @@ void fuzz_setup_http_post(FUZZ_DATA *fuzz, TLV *tlv)
struct curl_httppost *last = NULL;

fuzz->post_body = fuzz_tlv_to_string(tlv);
if (fuzz->post_body == NULL) {
return;
}

/* This is just one of several possible entrypoints to
* the HTTPPOST API. see https://curl.se/libcurl/c/curl_formadd.html
Expand Down