libssh2: fix memory leak in `SSH_SFTP_REALPATH` state

Seen in MSVC libssh2 CI job:
```
test 0615...[SFTP put remote failure]
test 0616...[SFTP retrieval of empty file]
test 0618...[SFTP retrieval of two files]
test 0620...[SFTP retrieval of missing file followed by good file]
test 0622...[SFTP put failure]
test 0637...[SFTP retrieval with invalid X- range]
test 0640...[SFTP --head retrieval]
  ** MEMORY FAILURE
  Leak detected: memory still allocated: 22 bytes
  At 2ae5b8a7ab8, there's 22 bytes.
   allocated by D:/a/curl/curl/lib/vssh/libssh2.c:2006
```
https://github.com/curl/curl/actions/runs/13752652590/job/38455575042?pr=16636#step:14:3907
https://github.com/curl/curl/actions/runs/13752879003/job/38456075461
https://github.com/curl/curl/actions/runs/13753706458/job/38457888479

Bug: https://github.com/curl/curl/pull/16636#issuecomment-2709086838
Co-authored-by: Daniel Stenberg
Closes #16639

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 78bf71b90f21974e1b02cf28aacc906bdf7259ad..4136c4b55419a7d6aa49d50ab1ed0a92976356c3 100644 (file)
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -926,8 +926,6 @@ jobs:
           TFLAGS+=' ~612'  # SFTP
           if [[ '${{ matrix.install }}' = *'libssh2[core,zlib]'* ]]; then
             TFLAGS+=' ~SFTP'
-          elif [[ '${{ matrix.install }}' = *'libssh2'* ]]; then
-            TFLAGS+=' ~615 ~616 ~618 ~620 ~622'  # Leak detected: memory still allocated: 22 bytes, allocated by D:/a/curl/curl/lib/vssh/libssh2.c:2006, sshc->homedir = strdup(sshp->readdir_filename);
           elif [[ '${{ matrix.install }}' = *'libssh '* ]]; then
             TFLAGS+=' ~614'  # 'SFTP pre-quote chmod' SFTP, pre-quote, directory
           fi

diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
index eaaa922a71fd9a92b5bbec4c899c9f89b5091f23..1bc7a5e14d10952be6984ccb2e175d9fd0982894 100644 (file)
--- a/lib/vssh/libssh2.c
+++ b/lib/vssh/libssh2.c
@@ -2003,6 +2003,7 @@ static CURLcode ssh_statemachine(struct Curl_easy *data, bool *block)
       if(rc > 0) {
         /* It seems that this string is not always NULL terminated */
         sshp->readdir_filename[rc] = '\0';
+        free(sshc->homedir);
         sshc->homedir = strdup(sshp->readdir_filename);
         if(!sshc->homedir) {
           state(data, SSH_SFTP_CLOSE);