Corrected several potential null dereference or memory leak issues detected by static analysis.
@@ -92,7 +92,8 @@ NC_authsetup(NCauth* auth, NCURI* uri)
if(uri != NULL)
uri_hostport = NC_combinehostport(uri);
-
+ else
+ return NC_EDAP; /* Generic EDAP error. */
setdefaults(auth);
/* Note, we still must do this function even if
@@ -136,6 +137,7 @@ NC_authsetup(NCauth* auth, NCURI* uri)
NC_rclookup("HTTP.SSL.VERIFYPEER",uri_hostport));
setauthfield(auth,"HTTP.NETRC",
NC_rclookup("HTTP.NETRC",uri_hostport));
+
{ /* Handle various cases for user + password */
/* First, see if the user+pwd was in the original url */
char* user = NULL;
@@ -155,13 +157,14 @@ NC_authsetup(NCauth* auth, NCURI* uri)
const char* userpwd = NC_rclookup("HTTP.CREDENTIALS.USERPASSWORD",uri_hostport);
if(userpwd != NULL) {
ret = NC_parsecredentials(userpwd,&user,&pwd);
- if(ret) return ret;
+ if(ret) {nullfree(uri_hostport); return ret;}
}
}
setauthfield(auth,"HTTP.USERNAME",user);
setauthfield(auth,"HTTP.PASSWORD",pwd);
nullfree(user);
nullfree(pwd);
+ nullfree(uri_hostport);
}
return (ret);
}
@@ -356,8 +359,10 @@ NC_parsecredentials(const char* userpwd, char** userp, char** pwdp)
if(user == NULL)
return NC_ENOMEM;
pwd = strchr(user,':');
- if(pwd == NULL)
+ if(pwd == NULL) {
+ free(user);
return NC_EINVAL;
+ }
*pwd = '\0';
pwd++;
if(userp)
@@ -380,4 +385,3 @@ setdefaults(NCauth* auth)
}
}
}
-
