[PECL-CVS] [pecl-web_services-oauth] memory-safety-audit: address reviews

Author: Rasmus Lerdorf (rlerdorf)
Date: 2026-04-04T21:43:53-04:00

Commit: https://github.com/php/pecl-web_services-oauth/commit/729394d83cae8b9bc4f6e16cd32f243780683cec
Raw diff: https://github.com/php/pecl-web_services-oauth/commit/729394d83cae8b9bc4f6e16cd32f243780683cec.diff

address reviews

Changed paths:
  M  oauth.c
  M  provider.c


Diff:

diff --git a/oauth.c b/oauth.c
index 98b93ee..2771bc9 100644
--- a/oauth.c
+++ b/oauth.c
@@ -168,14 +168,22 @@ static void so_object_free_storage(zend_object *obj) /* {{{ */
 	if (soo->timestamp) {
 		efree(soo->timestamp);
 	}
-	if (soo->multipart_files_num) {
+	if (soo->multipart_files || soo->multipart_params) {
 		int mi;
 		for (mi = 0; mi < soo->multipart_files_num; mi++) {
-			efree(soo->multipart_files[mi]);
-			efree(soo->multipart_params[mi]);
+			if (soo->multipart_files) {
+				efree(soo->multipart_files[mi]);
+			}
+			if (soo->multipart_params) {
+				efree(soo->multipart_params[mi]);
+			}
+		}
+		if (soo->multipart_files) {
+			efree(soo->multipart_files);
+		}
+		if (soo->multipart_params) {
+			efree(soo->multipart_params);
 		}
-		efree(soo->multipart_files);
-		efree(soo->multipart_params);
 	}
 
 }
diff --git a/provider.c b/provider.c
index 654411d..f459e34 100644
--- a/provider.c
+++ b/provider.c
@@ -214,12 +214,12 @@ static int oauth_provider_parse_auth_header(php_oauth_provider *sop, char *auth_
 #endif
 	size_t decoded_len;
 
-	if(!auth_header || strncasecmp(auth_header, "oauth", 4) || !sop) {
+	if(!auth_header || strlen(auth_header) < 6 || strncasecmp(auth_header, "oauth ", 6) || !sop) {
 		zend_string_release(regex);
 		return FAILURE;
 	}
 	/* pass "OAuth " */
-	auth_header += 5;
+	auth_header += 6;
 
 #if PHP_VERSION_ID >= 70400
 	s_auth_header = zend_string_init(auth_header, strlen(auth_header), 0);