Fix potential leak in request_set_header

Hrvoje Niksic <[email protected]>
Newsgroups gmane.comp.web.wget.patches
Message-ID <[email protected]>
request_set_header doesn't change the request if the header value is
NULL.  The current implementation allows a leak if someone tried to do
something like:

request_set_header (req, aprintf("%sConnection", proxy?"Proxy-":""),
                    value, rel_name);

If VALUE is NULL, the name will not be released.  No code in Wget does
this now, but in the future it well may.  This patch fixes the bug:

2005-04-17  Hrvoje Niksic  <[email protected]>

	* http.c (request_set_header): Free NAME when VALUE is NULL and
	freeing the header name is requested.

Index: src/http.c
===================================================================
RCS file: /pack/anoncvs/wget/src/http.c,v
retrieving revision 1.159
diff -u -r1.159 http.c
--- src/http.c	2005/04/16 13:06:29	1.159
+++ src/http.c	2005/04/17 16:57:21
@@ -234,7 +234,13 @@
   struct request_header *hdr;
   int i;
   if (!value)
-    return;
+    {
+      /* A NULL value is a no-op; if freeing the name is requested,
+	 free it now to avoid leaks.  */
+      if (release_policy == rel_name || release_policy == rel_both)
+	xfree (name);
+      return;
+    }
   for (i = 0; i < req->hcount; i++)
     {
       hdr = &req->headers[i];
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.