HexBrain

curl · Report #687734

Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failure

Informativestatus
mediumseverity
12 Jan 2021disclosed

How it was found

Summary:

When Curl_http_compile_trailers() fails, trailers_buf is freed twice, because we don't pass to this function the pointer value by reference.

Steps To Reproduce:

Did not actually reproduce, please double check patch attached and analysis.

Impact

Some memory corruption due to the double-free.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original