curl · Report #3710209
Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror
N/Astatus
lowseverity
21upvotes
5 May 2026disclosed
How it was found
Summary: A resource leak was identified in src/tool_parsecfg.c using the Clang Static Analyzer. When a file error occurs (fileerror is true) during config parsing, the function returns PARAM_READ_ERROR without ensuring the file stream is properly closed, leading to a potential file descriptor leak.
Steps to Reproduce:
1. Analyze the curl source code using scan-build make.
2. Observe the report for src/tool_parsecfg.c.
3. The analyzer identifies that at line 264, if fileerror is triggered, the control flow reaches the return statement at line 279 without
a confirmed fclose on the opened stream.
Impact
Impact: A local attacker could potentially cause a Denial of Service (DoS) by repeatedly triggering this error path, leading to file descriptor exhaustion.