search

siva-msft / curl

Other
0 stars 0 forks source link

Potential security issue in lib/curl_sasl.c: Unchecked return from initialization function #3

Closed monocle-ai closed 4 years ago

monocle-ai commented 4 years ago

What is a Conditionally Uninitialized Variable? When an initialization function is used to initialize a local variable, but the returned status code is not checked, reading the variable may result in undefined behaviour.

1 instance of this defect were found in the following locations:

Instance 1 File : lib/curl_sasl.c Function: Curl_sasl_continue https://github.com/siva-msft/curl/blob/a051c0f0a9057a792ce7dfa22bf761d36fc56a72/lib/curl_sasl.c#L476 Code extract:


#ifndef CURL_DISABLE_CRYPTO_AUTH
  case SASL_CRAMMD5:
    sasl->params->getmessage(data->state.buffer, &serverdata); <------ HERE
    result = Curl_auth_decode_cram_md5_message(serverdata, &chlg, &chlglen);
    if(!result)