maskit commented on PR #13636:
URL: https://github.com/apache/trafficserver/pull/13636#issuecomment-6303748545
The description says the release of `name` in
`_read_insert_without_name_ref()` when the value decode fails belongs in
#13655. #13655 has merged (`bfe88e104a`) and only changed the guards and added
a test; it did not add that release. So it still needs to be done, and it fits
in this PR.
When the value decode fails, `name` was already allocated by the preceding
successful decode and nothing frees it. Something like:
```cpp
// Value
if ((ret = xpack_decode_string(arena, value, tmp, input + read_len, input
+ input_len, _header_field_max_size, 7)) < 0 ||
tmp > 0xFFFF) {
arena.str_free(*name);
return -1;
}
```
`name` is the last allocation still outstanding at that point, so the free
rewinds. The Insert Without Name Ref regression test mentioned in the
description should also be possible now that the guards return on failure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
