[PECL-CVS] [pecl-web_services-oauth] memory-safety-audit: address reviews

Author: Rasmus Lerdorf (rlerdorf)
Date: 2026-04-04T22:12:41-04:00

Commit: https://github.com/php/pecl-web_services-oauth/commit/74034bb1dd8a6bf5d52e70d6157f93d25e130f0b
Raw diff: https://github.com/php/pecl-web_services-oauth/commit/74034bb1dd8a6bf5d52e70d6157f93d25e130f0b.diff

address reviews

Changed paths:
  M  oauth.c
  M  provider.c


Diff:

diff --git a/oauth.c b/oauth.c
index 2771bc9..f05a95b 100644
--- a/oauth.c
+++ b/oauth.c
@@ -1732,16 +1732,24 @@ static long oauth_fetch(php_so_object *soo, const char *url, const char *method,
 #endif
 		}
 
-		if (soo->multipart_files_num) {
+		if (soo->multipart_files || soo->multipart_params) {
 			int mi;
 			for (mi = 0; mi < soo->multipart_files_num; mi++) {
-				efree(soo->multipart_files[mi]);
-				efree(soo->multipart_params[mi]);
+				if (soo->multipart_files) {
+					efree(soo->multipart_files[mi]);
+				}
+				if (soo->multipart_params) {
+					efree(soo->multipart_params[mi]);
+				}
+			}
+			if (soo->multipart_files) {
+				efree(soo->multipart_files);
+				soo->multipart_files = NULL;
+			}
+			if (soo->multipart_params) {
+				efree(soo->multipart_params);
+				soo->multipart_params = NULL;
 			}
-			efree(soo->multipart_files);
-			efree(soo->multipart_params);
-			soo->multipart_files = NULL;
-			soo->multipart_params = NULL;
 			soo->multipart_files_num = 0;
 			soo->is_multipart = 0;
 		}
diff --git a/provider.c b/provider.c
index f459e34..1095791 100644
--- a/provider.c
+++ b/provider.c
@@ -197,9 +197,9 @@ static inline int oauth_provider_set_param_value(HashTable *ht, char *key, zval
 	Z_TRY_ADDREF_P(val);
 	if (zend_hash_str_update(ht, key, strlen(key), val) == NULL) {
 		Z_TRY_DELREF_P(val);
-		return FAILURE;
+		return 0;
 	}
-	return SUCCESS;
+	return 1;
 }
 /* }}} */
 
@@ -214,7 +214,7 @@ static int oauth_provider_parse_auth_header(php_oauth_provider *sop, char *auth_
 #endif
 	size_t decoded_len;
 
-	if(!auth_header || strlen(auth_header) < 6 || strncasecmp(auth_header, "oauth ", 6) || !sop) {
+	if(!auth_header || strncasecmp(auth_header, "oauth ", 6) || !sop) {
 		zend_string_release(regex);
 		return FAILURE;
 	}
@@ -290,7 +290,7 @@ static int oauth_provider_parse_auth_header(php_oauth_provider *sop, char *auth_
 			ZVAL_STRINGL(&decoded_val, tmp, decoded_len);
 			efree(tmp);
 
-			if (oauth_provider_set_param_value(sop->oauth_params, Z_STRVAL_P(current_param), &decoded_val)==FAILURE) {
+			if (!oauth_provider_set_param_value(sop->oauth_params, Z_STRVAL_P(current_param), &decoded_val)) {
 				zval_ptr_dtor(&decoded_val);
 				zval_ptr_dtor(&return_value);
 				zval_ptr_dtor(&subpats);
@@ -609,7 +609,7 @@ SOP_METHOD(__construct)
 		do {
 			if(zend_hash_get_current_key_ex(Z_ARRVAL_P(params), &key, &num_key, &hpos) == HASH_KEY_IS_STRING) {
 				if((item_param = zend_hash_get_current_data_ex(Z_ARRVAL_P(params), &hpos)) != NULL) {
-					if(oauth_provider_set_param_value(sop->oauth_params, ZSTR_VAL(key), item_param) == FAILURE) {
+					if(!oauth_provider_set_param_value(sop->oauth_params, ZSTR_VAL(key), item_param)) {
 						return;
 					}
 				}