Open coolc4 opened 2 years ago
edrav2/eprj/curl/lib/vtls/vtls.c:
CURLcode Curl_pin_peer_pubkey(struct Curl_easy data, const char pinnedpubkey, const unsigned char *pubkey, size_t pubkeylen) { ........
/* compute sha256sum of public key */ sha256sumdigest = malloc(CURL_SHA256_DIGEST_LENGTH); if(!sha256sumdigest) return CURLE_OUT_OF_MEMORY;
//sha256sumdigest malloc ok
encode = Curl_ssl->sha256sum(pubkey, pubkeylen, sha256sumdigest, CURL_SHA256_DIGEST_LENGTH); if(encode != CURLE_OK) return encode; **// here maybe memleak** encode = Curl_base64_encode(data, (char *)sha256sumdigest, CURL_SHA256_DIGEST_LENGTH, &encoded, &encodedlen); Curl_safefree(sha256sumdigest); if(encode) return encode;
.....
And I fixed the bug by th patch: curl_vtls_pubkey_memleak.txt
edrav2/eprj/curl/lib/vtls/vtls.c:
CURLcode Curl_pin_peer_pubkey(struct Curl_easy data, const char pinnedpubkey, const unsigned char *pubkey, size_t pubkeylen) { ........
//sha256sumdigest malloc ok
.....