curl · Report #687734
Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failure
Informativestatus
mediumseverity
12 Jan 2021disclosed
How it was found
Summary:
When Curl_http_compile_trailers() fails, trailers_buf is freed twice, because we don't pass to this function the pointer value by reference.
Steps To Reproduce:
Did not actually reproduce, please double check patch attached and analysis.
Impact
Some memory corruption due to the double-free.