OISF / libhtp

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces.
BSD 3-Clause "New" or "Revised" License
288 stars 115 forks source link

double free in multipart processing #402

Open whistlerwzc opened 1 year ago

whistlerwzc commented 1 year ago

In function htp_ch_multipart_callback_request_body_data at htp_content_handlers.c, if an error occurs while adding newly allocated params to tx->request_params, the func just returns without setting tx->request_mpartp->gave_up_data, thus there's a risk of double-free in htp_tx_destroy_incomplete. However, i don't have any ideas on how to resolve it at present so i try to look up for some suggestions here, Thx!