From: Michael Kaufmann <mail@michael-kaufmann.ch>
Date: Wed, 10 Oct 2018 20:53:50 +0000 (+0200)
Subject: Curl_follow: Always free the passed new URL
X-Git-Tag: curl-7_62_0~57
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6afe70a00bb4018810d8f4417bc49b44a7998e46;p=curl

Curl_follow: Always free the passed new URL

Closes #3124
---

diff --git a/lib/multi.c b/lib/multi.c
index 9a98435e6..acf9ecc6e 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -1725,6 +1725,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
             if(!drc || (drc == CURLE_SEND_ERROR)) {
               follow = FOLLOW_RETRY;
               drc = Curl_follow(data, newurl, follow);
+              newurl = NULL; /* freed by Curl_follow() */
               if(!drc) {
                 multistate(data, CURLM_STATE_CONNECT);
                 rc = CURLM_CALL_MULTI_PERFORM;
diff --git a/lib/transfer.c b/lib/transfer.c
index 638ae9ec5..2a348b687 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1500,8 +1500,10 @@ CURLcode Curl_follow(struct Curl_easy *data,
         }
 
         data->change.referer = strdup(data->change.url);
-        if(!data->change.referer)
+        if(!data->change.referer) {
+          free(newurl);
           return CURLE_OUT_OF_MEMORY;
+        }
         data->change.referer_alloc = TRUE; /* yes, free this later */
       }
     }