Memory leak from doh_write_cb

How it was found

Summary:

[summary of the vulnerability]

A memory leak found by curl_fuzzer_http

Affected version

[Which curl/libcurl version are you using to reproduce? On which platform? curl -V typically generates good output to include]

curl 8.13.0-DEV (x86_64-apple-darwin23.6.0) libcurl/8.13.0-DEV OpenSSL/1.0.2n zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 nghttp2/1.55.1 librtmp/2.3 Release-Date: [unreleased] Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp ws wss Features: alt-svc AsynchDNS HSTS HTTP2 HTTPS-proxy IDN IPv6 Largefile libz NTLM PSL SSL threadsafe TLS-SRP UnixSockets

Steps To Reproduce:

[add details for how we can reproduce the issue]

1. Run the fuzzer with reproducer

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

Stack trace is

==14==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 107 byte(s) in 1 object(s) allocated from:
    #0 0x55da4969379c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
    #1 0x55da496ff27b in curl_dbg_realloc /src/curl/lib/memdebug.c:265:9
    #2 0x55da497fc6f3 in dyn_nappend /src/curl/lib/dynbuf.c:111:15
    #3 0x55da497faee5 in doh_write_cb /src/curl/lib/doh.c:183:6
    #4 0x55da497f2636 in cw_out_ptr_flush /src/curl/lib/cw-out.c:224:16
    #5 0x55da497f1644 in cw_out_do_write /src/curl/lib/cw-out.c:383:14
    #6 0x55da497f0ab6 in cw_out_write /src/curl/lib/cw-out.c:416:14
    #7 0x55da497f2f62 in cw_pause_write /src/curl/lib/cw-pause.c:192:14
    #8 0x55da497476e1 in Curl_cwriter_write /src/curl/lib/sendf.c:184:10
    #9 0x55da497476e1 in cw_download_write /src/curl/lib/sendf.c:312:14
    #10 0x55da497415b9 in Curl_cwriter_write /src/curl/lib/sendf.c:184:10
    #11 0x55da497415b9 in Curl_client_write /src/curl/lib/sendf.c:92:12
    #12 0x55da498363a5 in Curl_http_write_resp /src/curl/lib/http.c:4201:14
    #13 0x55da49762635 in Curl_xfer_write_resp /src/curl/lib/transfer.c:862:14
    #14 0x55da4975e364 in sendrecv_dl /src/curl/lib/transfer.c:342:14
    #15 0x55da4975e364 in Curl_sendrecv /src/curl/lib/transfer.c:441:14
    #16 0x55da497250f5 in state_performing /src/curl/lib/multi.c:1733:12
    #17 0x55da497250f5 in multi_runsingle /src/curl/lib/multi.c:2423:12
    #18 0x55da497222f2 in curl_multi_perform /src/curl/lib/multi.c:2599:16
    #19 0x55da496d3e98 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:419:5
    #20 0x55da496d2e47 in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:97:3

You need to pass -runs=100 like /out/curl_fuzzer_http /out/leak-247f5201c537eecc44d9f44dd815fd43f19a8a72 -runs=100 as it does not happen on every case

Impact

Summary:

I guess memory leaks may ultimately lead to DOS...