Curl_follow: Always free the passed new URL

Closes #3124

diff --git a/lib/multi.c b/lib/multi.c
index 9a98435e6f02f23b97a4b6e6f48a13065073ae93..acf9ecc6e24bee728ed4e103e9e4d73c411ad45a 100644 (file)
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -1725,6 +1725,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
             if(!drc || (drc == CURLE_SEND_ERROR)) {
               follow = FOLLOW_RETRY;
               drc = Curl_follow(data, newurl, follow);
+              newurl = NULL; /* freed by Curl_follow() */
               if(!drc) {
                 multistate(data, CURLM_STATE_CONNECT);
                 rc = CURLM_CALL_MULTI_PERFORM;

diff --git a/lib/transfer.c b/lib/transfer.c
index 638ae9ec54419779b6ba1caaa2e184dfab3cc059..2a348b68742050f7716b57c043dae007870883c2 100644 (file)
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1500,8 +1500,10 @@ CURLcode Curl_follow(struct Curl_easy *data,
         }
 
         data->change.referer = strdup(data->change.url);
-        if(!data->change.referer)
+        if(!data->change.referer) {
+          free(newurl);
           return CURLE_OUT_OF_MEMORY;
+        }
         data->change.referer_alloc = TRUE; /* yes, free this later */
       }
     }