lib5004: fix memleak on OOM, check all slist append results (httpsig)

Detected by torture tests:
```
test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)]
 105 functions found, but only fail 25 (23.81%)
** MEMORY FAILURE
Leak detected: memory still allocated: 99 bytes
At 6000022c9408, there is 36 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000039c8e78, there is 31 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000037dd688, there is 16 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:62
At 6000037dd628, there is 16 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:62
LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit
 5004: torture FAILED: function number 10 in test.
```
Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331

Also:
- enable HTTPSIG in torture tests.
- NULL check all `curl_slist_append()` results.
- apply a NULL check to sibling test 5000 also.

Co-authored-by: Daniel Stenberg
Follow-up to a55731050e8c3dbea0b96205cf916443118f6acb #22386 #21239

Closes #22437

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index be7ab8a09bab41e338a37475ef75d130ab76c3d0..fb3a2eae9ad6e26052c8a6dbab4129faba46e755 100644 (file)
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -296,13 +296,13 @@ jobs:
             install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
             tflags: '-t --shallow=25 --min=960 1 to 1000'
             torture: true
-            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON
+            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF
 
           - name: 'openssl torture 2'
             install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
             tflags: '-t --shallow=25 --min=915 1001 to 9999'
             torture: true
-            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON
+            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF
 
           - name: 'openssl i686'
             install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 libssh2-1-dev:i386 libidn2-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386

diff --git a/tests/libtest/lib5000.c b/tests/libtest/lib5000.c
index a0eb92f0aebb6a8e6af97802f7e0d893a23effda..05c5b99ac4fa68f188a8758a9fe9fe95df4e40fd 100644 (file)
--- a/tests/libtest/lib5000.c
+++ b/tests/libtest/lib5000.c
@@ -50,7 +50,9 @@ static CURLcode test_lib5000(const char *URL)
   easy_setopt(curl, CURLOPT_HEADER, 0L);
   easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
-    connect_to = curl_slist_append(connect_to, libtest_arg2);
+    connect_to = curl_slist_append(NULL, libtest_arg2);
+    if(!connect_to)
+      goto test_cleanup;
   }
   easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);
 

diff --git a/tests/libtest/lib5004.c b/tests/libtest/lib5004.c
index 1f6fb1a2239991ad9d65640c606c6cc8a51b9be3..767bec410a63334ab41b1bead2e12a4fd05c0c6b 100644 (file)
--- a/tests/libtest/lib5004.c
+++ b/tests/libtest/lib5004.c
@@ -34,6 +34,7 @@ static CURLcode test_lib5004(const char *URL)
   CURLcode result = TEST_ERR_MAJOR_BAD;
   struct curl_slist *connect_to = NULL;
   struct curl_slist *headers = NULL;
+  struct curl_slist *nheaders;
 
   if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
     curl_mfprintf(stderr, "curl_global_init() failed\n");
@@ -57,18 +58,28 @@ static CURLcode test_lib5004(const char *URL)
               "date: method path authority content-type: content-length:");
   easy_setopt(curl, CURLOPT_POSTFIELDS, "{\"hello\": \"world\"}");
 
-  headers = curl_slist_append(headers,
-                              "Date: Tue, 20 Apr 2021 02:07:55 GMT");
-  headers = curl_slist_append(headers,
-                              "Content-Type: application/json");
-  headers = curl_slist_append(headers,
-                              "Content-Length: 18");
+  headers = curl_slist_append(NULL, "Date: Tue, 20 Apr 2021 02:07:55 GMT");
+  if(!headers)
+    goto test_cleanup;
+
+  nheaders = curl_slist_append(headers, "Content-Type: application/json");
+  if(!nheaders)
+    goto test_cleanup;
+  headers = nheaders;
+
+  nheaders = curl_slist_append(headers, "Content-Length: 18");
+  if(!nheaders)
+    goto test_cleanup;
+  headers = nheaders;
+
   easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
 
   easy_setopt(curl, CURLOPT_HEADER, 0L);
   easy_setopt(curl, CURLOPT_URL, URL);
   if(libtest_arg2) {
-    connect_to = curl_slist_append(connect_to, libtest_arg2);
+    connect_to = curl_slist_append(NULL, libtest_arg2);
+    if(!connect_to)
+      goto test_cleanup;
   }
   easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);