baf15ab
From 5cdcf1dbd39c64e18a81fc912a36942a3ec87565 Mon Sep 17 00:00:00 2001
baf15ab
From: Daniel Stenberg <daniel@haxx.se>
baf15ab
Date: Mon, 19 Dec 2022 08:38:37 +0100
baf15ab
Subject: [PATCH] smb/telnet: do not free the protocol struct in *_done()
baf15ab
baf15ab
It is managed by the generic layer.
baf15ab
baf15ab
Reported-by: Trail of Bits
baf15ab
baf15ab
Closes #10112
baf15ab
baf15ab
Upstream-commit: 4f20188ac644afe174be6005ef4f6ffba232b8b2
baf15ab
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
baf15ab
---
baf15ab
 lib/smb.c    | 14 ++------------
baf15ab
 lib/telnet.c |  3 ---
baf15ab
 2 files changed, 2 insertions(+), 15 deletions(-)
baf15ab
baf15ab
diff --git a/lib/smb.c b/lib/smb.c
baf15ab
index 039d680..f682c1f 100644
baf15ab
--- a/lib/smb.c
baf15ab
+++ b/lib/smb.c
baf15ab
@@ -62,8 +62,6 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done);
baf15ab
 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
baf15ab
 static CURLcode smb_do(struct Curl_easy *data, bool *done);
baf15ab
 static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
baf15ab
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
baf15ab
-                         bool premature);
baf15ab
 static CURLcode smb_disconnect(struct Curl_easy *data,
baf15ab
                                struct connectdata *conn, bool dead);
baf15ab
 static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
baf15ab
@@ -78,7 +76,7 @@ const struct Curl_handler Curl_handler_smb = {
baf15ab
   "SMB",                                /* scheme */
baf15ab
   smb_setup_connection,                 /* setup_connection */
baf15ab
   smb_do,                               /* do_it */
baf15ab
-  smb_done,                             /* done */
baf15ab
+  ZERO_NULL,                            /* done */
baf15ab
   ZERO_NULL,                            /* do_more */
baf15ab
   smb_connect,                          /* connect_it */
baf15ab
   smb_connection_state,                 /* connecting */
baf15ab
@@ -105,7 +103,7 @@ const struct Curl_handler Curl_handler_smbs = {
baf15ab
   "SMBS",                               /* scheme */
baf15ab
   smb_setup_connection,                 /* setup_connection */
baf15ab
   smb_do,                               /* do_it */
baf15ab
-  smb_done,                             /* done */
baf15ab
+  ZERO_NULL,                            /* done */
baf15ab
   ZERO_NULL,                            /* do_more */
baf15ab
   smb_connect,                          /* connect_it */
baf15ab
   smb_connection_state,                 /* connecting */
baf15ab
@@ -941,14 +939,6 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
baf15ab
   return CURLE_OK;
baf15ab
 }
baf15ab
 
baf15ab
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
baf15ab
-                         bool premature)
baf15ab
-{
baf15ab
-  (void) premature;
baf15ab
-  Curl_safefree(data->req.p.smb);
baf15ab
-  return status;
baf15ab
-}
baf15ab
-
baf15ab
 static CURLcode smb_disconnect(struct Curl_easy *data,
baf15ab
                                struct connectdata *conn, bool dead)
baf15ab
 {
baf15ab
diff --git a/lib/telnet.c b/lib/telnet.c
baf15ab
index 923c7f8..48cd0d7 100644
baf15ab
--- a/lib/telnet.c
baf15ab
+++ b/lib/telnet.c
baf15ab
@@ -1248,9 +1248,6 @@ static CURLcode telnet_done(struct Curl_easy *data,
baf15ab
 
baf15ab
   curl_slist_free_all(tn->telnet_vars);
baf15ab
   tn->telnet_vars = NULL;
baf15ab
-
baf15ab
-  Curl_safefree(data->req.p.telnet);
baf15ab
-
baf15ab
   return CURLE_OK;
baf15ab
 }
baf15ab
 
baf15ab
-- 
baf15ab
2.38.1
baf15ab