commit df28ed6116862921994b1abc5147cb64360e4241
author Daniel Stenberg <daniel@haxx.se> Mon Apr 20 09:02:47 2020 +0200
committer Daniel Stenberg <daniel@haxx.se> Mon Apr 20 14:24:56 2020 +0200
tree d0a2ed86966d80c8c24036c0bdf649210d6048df
parent 10822c652c5f4c4e979b847b18512b318e2301e9

http: free memory when Alt-Used header creation fails due to OOM

Reported-by: James Fuller
Fixes #5268
Closes #5269

lib/http.c

diff --git a/lib/http.c b/lib/http.c
index 5a2edf0..c3f7c35 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -1333,7 +1333,6 @@
 {
   char *s;
   va_list ap;
-  Curl_send_buffer *in = *inp;
   va_start(ap, fmt);
   s = vaprintf(fmt, ap); /* this allocs a new string to append */
   va_end(ap);
@@ -1344,9 +1343,7 @@
     return result;
   }
   /* If we failed, we cleanup the whole buffer and return error */
-  free(in->buffer);
-  free(in);
-  *inp = NULL;
+  Curl_add_buffer_free(inp);
   return CURLE_OUT_OF_MEMORY;
 }
 
@@ -1363,9 +1360,7 @@
     /* If resulting used size of send buffer would wrap size_t, cleanup
        the whole buffer and return error. Otherwise the required buffer
        size will fit into a single allocatable memory chunk */
-    Curl_safefree(in->buffer);
-    free(in);
-    *inp = NULL;
+    Curl_add_buffer_free(inp);
     return CURLE_OUT_OF_MEMORY;
   }
 
@@ -2615,8 +2610,10 @@
   if(conn->bits.altused && !Curl_checkheaders(conn, "Alt-Used")) {
     altused = aprintf("Alt-Used: %s:%d\r\n",
                       conn->conn_to_host.name, conn->conn_to_port);
-    if(!altused)
+    if(!altused) {
+      Curl_add_buffer_free(&req_buffer);
       return CURLE_OUT_OF_MEMORY;
+    }
   }
 #endif
   result =