From: Viktor Szakats Date: Wed, 29 Jul 2026 21:30:51 +0000 (+0200) Subject: lib5004: fix memleak on OOM, check all slist append results (httpsig) X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ddb22d12c2a3336b33b3e2c9b7fc0da5b893de49;p=thirdparty%2Fcurl.git lib5004: fix memleak on OOM, check all slist append results (httpsig) Detected by torture tests: ``` test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)] 105 functions found, but only fail 25 (23.81%) ** MEMORY FAILURE Leak detected: memory still allocated: 99 bytes At 6000022c9408, there is 36 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:87 At 6000039c8e78, there is 31 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:87 At 6000037dd688, there is 16 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:62 At 6000037dd628, there is 16 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:62 LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit 5004: torture FAILED: function number 10 in test. ``` Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331 Also: - enable HTTPSIG in torture tests. - NULL check all `curl_slist_append()` results. - apply a NULL check to sibling test 5000 also. Co-authored-by: Daniel Stenberg Follow-up to a55731050e8c3dbea0b96205cf916443118f6acb #22386 #21239 Closes #22437 --- diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index be7ab8a09b..fb3a2eae9a 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -296,13 +296,13 @@ jobs: install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev tflags: '-t --shallow=25 --min=960 1 to 1000' torture: true - generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON + generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF - name: 'openssl torture 2' install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev tflags: '-t --shallow=25 --min=915 1001 to 9999' torture: true - generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON + generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF - name: 'openssl i686' install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 libssh2-1-dev:i386 libidn2-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386 diff --git a/tests/libtest/lib5000.c b/tests/libtest/lib5000.c index a0eb92f0ae..05c5b99ac4 100644 --- a/tests/libtest/lib5000.c +++ b/tests/libtest/lib5000.c @@ -50,7 +50,9 @@ static CURLcode test_lib5000(const char *URL) easy_setopt(curl, CURLOPT_HEADER, 0L); easy_setopt(curl, CURLOPT_URL, URL); if(libtest_arg2) { - connect_to = curl_slist_append(connect_to, libtest_arg2); + connect_to = curl_slist_append(NULL, libtest_arg2); + if(!connect_to) + goto test_cleanup; } easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to); diff --git a/tests/libtest/lib5004.c b/tests/libtest/lib5004.c index 1f6fb1a223..767bec410a 100644 --- a/tests/libtest/lib5004.c +++ b/tests/libtest/lib5004.c @@ -34,6 +34,7 @@ static CURLcode test_lib5004(const char *URL) CURLcode result = TEST_ERR_MAJOR_BAD; struct curl_slist *connect_to = NULL; struct curl_slist *headers = NULL; + struct curl_slist *nheaders; if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { curl_mfprintf(stderr, "curl_global_init() failed\n"); @@ -57,18 +58,28 @@ static CURLcode test_lib5004(const char *URL) "date: method path authority content-type: content-length:"); easy_setopt(curl, CURLOPT_POSTFIELDS, "{\"hello\": \"world\"}"); - headers = curl_slist_append(headers, - "Date: Tue, 20 Apr 2021 02:07:55 GMT"); - headers = curl_slist_append(headers, - "Content-Type: application/json"); - headers = curl_slist_append(headers, - "Content-Length: 18"); + headers = curl_slist_append(NULL, "Date: Tue, 20 Apr 2021 02:07:55 GMT"); + if(!headers) + goto test_cleanup; + + nheaders = curl_slist_append(headers, "Content-Type: application/json"); + if(!nheaders) + goto test_cleanup; + headers = nheaders; + + nheaders = curl_slist_append(headers, "Content-Length: 18"); + if(!nheaders) + goto test_cleanup; + headers = nheaders; + easy_setopt(curl, CURLOPT_HTTPHEADER, headers); easy_setopt(curl, CURLOPT_HEADER, 0L); easy_setopt(curl, CURLOPT_URL, URL); if(libtest_arg2) { - connect_to = curl_slist_append(connect_to, libtest_arg2); + connect_to = curl_slist_append(NULL, libtest_arg2); + if(!connect_to) + goto test_cleanup; } easy_setopt(curl, CURLOPT_CONNECT_TO, connect_to);