[PECL-CVS] [pecl-web_services-oauth] memory-safety-audit: address reviews

Author: Rasmus Lerdorf (rlerdorf)
Date: 2026-04-04T21:01:22-04:00

Commit: https://github.com/php/pecl-web_services-oauth/commit/53f721f4afc3e333d1a0c15bed243538e3d70a4f
Raw diff: https://github.com/php/pecl-web_services-oauth/commit/53f721f4afc3e333d1a0c15bed243538e3d70a4f.diff

address reviews

Changed paths:
  M  oauth.c
  M  provider.c


Diff:

diff --git a/oauth.c b/oauth.c
index 7b0aa98..98b93ee 100644
--- a/oauth.c
+++ b/oauth.c
@@ -1720,23 +1720,24 @@ static long oauth_fetch(php_so_object *soo, const char *url, const char *method,
 #if OAUTH_USE_CURL
 			case OAUTH_REQENGINE_CURL:
 				http_response_code = make_req_curl(soo, surl.c, &payload, final_http_method, &rheaders);
-				if (soo->multipart_files_num) {
-					int mi;
-					for (mi = 0; mi < soo->multipart_files_num; mi++) {
-						efree(soo->multipart_files[mi]);
-						efree(soo->multipart_params[mi]);
-					}
-					efree(soo->multipart_files);
-					efree(soo->multipart_params);
-					soo->multipart_files = NULL;
-					soo->multipart_params = NULL;
-					soo->multipart_files_num = 0;
-					soo->is_multipart = 0;
-				}
 				break;
 #endif
 		}
 
+		if (soo->multipart_files_num) {
+			int mi;
+			for (mi = 0; mi < soo->multipart_files_num; mi++) {
+				efree(soo->multipart_files[mi]);
+				efree(soo->multipart_params[mi]);
+			}
+			efree(soo->multipart_files);
+			efree(soo->multipart_params);
+			soo->multipart_files = NULL;
+			soo->multipart_params = NULL;
+			soo->multipart_files_num = 0;
+			soo->is_multipart = 0;
+		}
+
 		is_redirect = HTTP_IS_REDIRECT(http_response_code);
 
 		if(soo->debug) {
diff --git a/provider.c b/provider.c
index 3f73aca..56dffc7 100644
--- a/provider.c
+++ b/provider.c
@@ -206,20 +206,21 @@ static int oauth_provider_parse_auth_header(php_oauth_provider *sop, char *auth_
 	HashPosition hpos;
 	zend_string *regex = zend_string_init(OAUTH_REGEX, sizeof(OAUTH_REGEX) - 1, 0);
 #if PHP_VERSION_ID >= 70400
-	zend_string *s_auth_header = zend_string_init(auth_header, strlen(auth_header), 0);
+	zend_string *s_auth_header;
 #endif
 	size_t decoded_len;
 
 	if(!auth_header || strncasecmp(auth_header, "oauth", 4) || !sop) {
-#if PHP_VERSION_ID >= 70400
-		zend_string_release(s_auth_header);
-#endif
 		zend_string_release(regex);
 		return FAILURE;
 	}
 	/* pass "OAuth " */
 	auth_header += 5;
 
+#if PHP_VERSION_ID >= 70400
+	s_auth_header = zend_string_init(auth_header, strlen(auth_header), 0);
+#endif
+
 	if ((pce = pcre_get_compiled_regex_cache(regex)) == NULL) {
 #if PHP_VERSION_ID >= 70400
 		zend_string_release(s_auth_header);