diff options
| author | mrg <mrg@NetBSD.org> | 2018-11-19 04:13:09 +0000 |
|---|---|---|
| committer | mrg <mrg@NetBSD.org> | 2018-11-19 04:13:09 +0000 |
| commit | 9b8a4689b3fe88bfb05fced3b10d0fcb1f5b688e (patch) | |
| tree | b60c356995b1f2c4355c6fb13235207eb1b6b8e3 /libexec/httpd | |
| parent | 9b0006e2e692d1c6e047773ced444a948b10b746 (diff) | |
avoid memory leak in sending multiple auth headers.
mostly mitigated by previous patch to limit total header size,
but still a real problem here.
Diffstat (limited to 'libexec/httpd')
| -rw-r--r-- | libexec/httpd/auth-bozo.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libexec/httpd/auth-bozo.c b/libexec/httpd/auth-bozo.c index 33b57264c8b..dc535ac76dc 100644 --- a/libexec/httpd/auth-bozo.c +++ b/libexec/httpd/auth-bozo.c @@ -1,4 +1,4 @@ -/* $NetBSD: auth-bozo.c,v 1.18 2015/12/27 10:21:35 mrg Exp $ */ +/* $NetBSD: auth-bozo.c,v 1.19 2018/11/19 04:13:09 mrg Exp $ */ /* $eterna: auth-bozo.c,v 1.17 2011/11/18 09:21:15 mrg Exp $ */ @@ -147,6 +147,10 @@ bozo_auth_check_headers(bozo_httpreq_t *request, char *val, char *str, char *pass = NULL; ssize_t alen; + /* free prior entries. */ + free(request->hr_authuser); + free(request->hr_authpass); + alen = base64_decode((unsigned char *)str + 6, (size_t)(len - 6), (unsigned char *)authbuf, @@ -158,8 +162,6 @@ bozo_auth_check_headers(bozo_httpreq_t *request, char *val, char *str, return bozo_http_error(httpd, 400, request, "bad authorization field"); *pass++ = '\0'; - free(request->hr_authuser); - free(request->hr_authpass); request->hr_authuser = bozostrdup(httpd, request, authbuf); request->hr_authpass = bozostrdup(httpd, request, pass); debug((httpd, DEBUG_FAT, |
