From: Viktor Szakats <commit@vsz.me>
Date: Wed, 29 Jul 2026 15:09:06 +0000 (+0200)
Subject: urlapi: clear password buffer on error path
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=64f746ee1e71f1079424cc173b7ec9d93adbb169;p=thirdparty%2Fcurl.git

urlapi: clear password buffer on error path

Reported by Copilot
Bug: https://github.com/curl/curl/pull/21637#pullrequestreview-4809702512
Follow-up to 112a8b5adf36c17e7816a8db701b3e7a22958e52 #21637
Follow-up to 7c34365ccea19949317878c7fcd5f7376e2e09f1 #21879

Closes #22432
---

diff --git a/lib/urlapi.c b/lib/urlapi.c
index b4dfdda678..1e61fbcae5 100644
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -347,6 +347,7 @@ out:
   curlx_free(passwdp);
   curlx_free(optionsp);
   curlx_safefree(u->user);
+  curlx_strzero(u->password);
   curlx_safefree(u->password);
   curlx_safefree(u->options);