Skip to content
Permalink
Browse files

smtp_done: free data before returning (on send failure)

... as otherwise it could leak that memory.

Detected by OSS-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3600

Assisted-by: Max Dymond
Closes #1977
  • Loading branch information...
bagder committed Oct 10, 2017
1 parent ecf21c5 commit 38ab7b4ccb18f03c0323d412ff0f3613cd66f5e5
Showing with 3 additions and 3 deletions.
  1. +3 −3 lib/smtp.c
@@ -1188,6 +1188,9 @@ static CURLcode smtp_done(struct connectdata *conn, CURLcode status,
if(!smtp || !pp->conn)
return CURLE_OK;

/* Cleanup our per-request based variables */
Curl_safefree(smtp->custom);

if(status) {
connclose(conn, "SMTP done with bad status"); /* marked for closure */
result = status; /* use the already set error code */
@@ -1246,9 +1249,6 @@ static CURLcode smtp_done(struct connectdata *conn, CURLcode status,
result = smtp_block_statemach(conn);
}

/* Cleanup our per-request based variables */
Curl_safefree(smtp->custom);

/* Clear the transfer mode for the next request */
smtp->transfer = FTPTRANSFER_BODY;

0 comments on commit 38ab7b4

Please sign in to comment.
You can’t perform that action at this time.