David Byron found a problem multiple -d options when libcurl was built with

--enable-debug, as then curl used free() on memory allocated both with
normal malloc() and with libcurl-provided functions, when the latter MUST be
freed with curl_free() in debug builds.

diff --git a/CHANGES b/CHANGES
index 66022988475b18fb0f8c7fefa61482c465f64d6d..62296efa0c0ffe2bcc7307d8e35331753dc8d3f9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,12 @@
 
                                   Changelog
 
+Daniel (27 March 2006)
+- David Byron found a problem multiple -d options when libcurl was built with
+  --enable-debug, as then curl used free() on memory allocated both with
+  normal malloc() and with libcurl-provided functions, when the latter MUST be
+  freed with curl_free() in debug builds.
+
 Daniel (26 March 2006)
 - Tor Arntsen figured out that TFTP was broken on a lot of systems since we
   called bind() with a too big argument in the 3rd parameter and at least

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index aad60791dbff69cf00d0e1c5008859caf8e576cf..73d5165b0c199a318d06d8d69142e2d1c7196e27 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -16,6 +16,7 @@ This release includes the following changes:
 
 This release includes the following bugfixes:
 
+ o fixed debug build crash with -d
  o TFTP works on more systems
  o generates a fine AIX Toolbox RPM spec
  o treat FTP AUTH failures properly
@@ -29,6 +30,7 @@ Other curl-related news since the previous public release:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
- Dan Fandrich, Ilja van Sprundel, David McCreedy, Tor Arntsen, Xavier Bouchoux
+ Dan Fandrich, Ilja van Sprundel, David McCreedy, Tor Arntsen, Xavier Bouchoux,
+ David Byron
 
         Thanks! (and sorry if I forgot to mention someone)

diff --git a/src/main.c b/src/main.c
index 0e1935670df26bceb9f830b445fe443a5c597d43..10aafd81c7b9ee7f6f9bad23b9d6d44b6f148fa9 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -1892,7 +1892,11 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */
           /* we already have a string, we append this one
              with a separating &-letter */
           char *oldpost=config->postfields;
-          config->postfields=aprintf("%s&%s", oldpost, postdata);
+          size_t newlen = strlen(oldpost) + strlen(postdata) + 2;
+          config->postfields=malloc(newlen);
+          if(!config->postfields)
+            return PARAM_NO_MEM;
+          snprintf(config->postfields, newlen, "%s&%s", oldpost, postdata);
           free(oldpost);
           free(postdata);
         }