Skip to content

schannel: Do not leak memory on failed setting algorithm cipher list - #19118

Closed
MegaManSec wants to merge 3 commits into
curl:masterfrom
MegaManSec:ml
Closed

schannel: Do not leak memory on failed setting algorithm cipher list#19118
MegaManSec wants to merge 3 commits into
curl:masterfrom
MegaManSec:ml

Conversation

@MegaManSec

@MegaManSec MegaManSec commented Oct 18, 2025

Copy link
Copy Markdown
Contributor

Discovered by ZeroPath.

@github-actions github-actions Bot added TLS Windows Windows-specific labels Oct 18, 2025
@MegaManSec

MegaManSec commented Oct 18, 2025

Copy link
Copy Markdown
Contributor Author

P.S: It's not clear whether backend->cred->cred_handle needs to be freed in case of if(sspi_status != SEC_E_OK). If it does, probably the latest Curl_safefree(backend->cred); should be replaced with schannel_session_free().

@bagder

bagder commented Oct 18, 2025

Copy link
Copy Markdown
Member

@jay what do you say?

@bagder
bagder requested a review from jay October 18, 2025 21:23
jay
jay requested changes Oct 18, 2025
View reviewed changes
Comment thread lib/vtls/schannel.c Outdated
@jay jay closed this in 66e3ff5 Oct 19, 2025
@jay

jay commented Oct 19, 2025

Copy link
Copy Markdown
Member

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jay jay jay requested changes

Assignees

No one assigned

Labels

TLS Windows Windows-specific

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@MegaManSec @bagder @jay