OOM fixes in http_negociate.c and lib/splay.c

Fix 2 OOM errors: a missing NULL-check in lib/http_negociate.c
and a potential NULL dereferencing in lib/splay.c

diff --git a/CHANGES b/CHANGES
index f70a58fa756b0a115d2c20c03975c1bdea105949..601368811516cf024fe2c4e1db48b878569fa93b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,9 @@
 
                                   Changelog
 
+- Julien Chaffraix fixed 2 OOM errors: a missing NULL-check in
+  lib/http_negociate.c and a potential NULL dereferencing in lib/splay.c
+
 Daniel Stenberg (25 May 2010)
 - Howard Chu brought a patch that makes the LDAP code much cleaner, nicer and
   in general being a better libcurl citizen. If a new enough OpenLDAP version

diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c
index 956f7342b19641f64c6bc9d9f5b3a8d7329895d5..d51d456313fa1d5dd5318791cac91be288b5c356 100644 (file)
--- a/lib/http_negotiate.c
+++ b/lib/http_negotiate.c
@@ -308,6 +308,8 @@ CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
       free(neg_ctx->output_token.value);
       responseToken = NULL;
       neg_ctx->output_token.value = malloc(spnegoTokenLength);
+      if(neg_ctx->output_token.value == NULL)
+        return CURLE_OUT_OF_MEMORY;
       memcpy(neg_ctx->output_token.value, spnegoToken,spnegoTokenLength);
       neg_ctx->output_token.length = spnegoTokenLength;
       free(spnegoToken);

diff --git a/lib/splay.c b/lib/splay.c
index db3dbeaf041a5aa409ea09ea542cab3d092ad1c6..dcc42cf26f942bb1cce95aae56d3188c120235c0 100644 (file)
--- a/lib/splay.c
+++ b/lib/splay.c
@@ -394,6 +394,10 @@ int main(int argc, argv_item_t argv[])
   for (i = 0; i < MAX; i++) {
     struct timeval key;
     ptrs[i] = t = malloc(sizeof(struct Curl_tree));
+    if(!t) {
+      puts("out of memory!");
+      return 0;
+    }
 
     key.tv_sec = 0;
 #ifdef TEST2
@@ -405,10 +409,6 @@ int main(int argc, argv_item_t argv[])
 #endif
 
     t->payload = (void *)key.tv_usec; /* for simplicity */
-    if(!t) {
-      puts("out of memory!");
-      return 0;
-    }
     root = Curl_splayinsert(key, root, t);
   }