Fixes some more out of memory handling bugs.

diff --git a/lib/base64.c b/lib/base64.c
index d78ba663ee1aa323a22636b1bcb5f0614ed5ad7e..5669e4c1dfcc20ee44513f1b09e56405f505377c 100644 (file)
--- a/lib/base64.c
+++ b/lib/base64.c
@@ -173,11 +173,13 @@ size_t Curl_base64_encode(struct SessionHandle *data,
   if(data) {
     convbuf = (char*)malloc(insize);
     if(!convbuf) {
+      free(output);
       return 0;
     }
     memcpy(convbuf, indata, insize);
     if(CURLE_OK != Curl_convert_to_network(data, convbuf, insize)) {
       free(convbuf);
+      free(output);
       return 0;
     }
     indata = convbuf; /* switch to the converted buffer */

diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c
index bdfeefa0a59637158baaeaa7e44d228946fa5e15..ac93413cf693769698c5f4982a429ea1cc683a00 100644 (file)
--- a/lib/http_negotiate.c
+++ b/lib/http_negotiate.c
@@ -295,7 +295,7 @@ CURLcode Curl_output_negotiate(struct connectdata *conn)
                            neg_ctx->output_token.length,
                            &encoded);
 
-  if (len < 0)
+  if (len == 0)
     return CURLE_OUT_OF_MEMORY;
 
   conn->allocptr.userpwd =

diff --git a/lib/http_ntlm.c b/lib/http_ntlm.c
index cc307f72d58c37afe85026c096e38bdd1e4af912..b4df726b5dddf542b1b46fdc6d04ab28bf969103 100644 (file)
--- a/lib/http_ntlm.c
+++ b/lib/http_ntlm.c
@@ -421,6 +421,10 @@ static void mk_nt_hash(struct SessionHandle *data,
 {
   size_t len = strlen(password);
   unsigned char *pw = malloc(len*2);
+  if (!pw)
+    /* No way to report this error; just rely on future malloc failures
+       to be caught */
+    return;
 
   utf8_to_unicode_le(pw, password, len);
 

diff --git a/lib/url.c b/lib/url.c
index 0ae0197d3ce652f3cac55cf13744c5b21f49ad1c..edbd1157c47e0bf2e9bbf4e2c559751435ec2964 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -2856,6 +2856,8 @@ static CURLcode CreateConnection(struct SessionHandle *data,
   /* Initialize the pipeline lists */
   conn->send_pipe = Curl_llist_alloc((curl_llist_dtor) llist_dtor);
   conn->recv_pipe = Curl_llist_alloc((curl_llist_dtor) llist_dtor);
+  if (!conn->send_pipe || !conn->recv_pipe)
+    return CURLE_OUT_OF_MEMORY;
 
   /* Store creation time to help future close decision making */
   conn->created = Curl_tvnow();