http: fix the check for 'Authorization' with Bearer #6988
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The code would wrongly check for it using an additional colon. Reported-by: Blake Burkhart
steini2000
added a commit
to steini2000/curl
that referenced
this pull request
May 4, 2021
* make constant more readable * symbols-in-version * http2: fix resource leaks in set_transfer_url() ... detected by Coverity: Error: RESOURCE_LEAK (CWE-772): lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". lib/http2.c:486: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:488: leaked_storage: Variable "u" going out of scope leaks the storage it points to. Error: RESOURCE_LEAK (CWE-772): lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". lib/http2.c:493: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:495: leaked_storage: Variable "u" going out of scope leaks the storage it points to. Error: RESOURCE_LEAK (CWE-772): lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". lib/http2.c:500: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:502: leaked_storage: Variable "u" going out of scope leaks the storage it points to. Error: RESOURCE_LEAK (CWE-772): lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". lib/http2.c:505: noescape: Resource "u" is not freed or pointed-to in "curl_url_get". [Note: The source code implementation of the function has been overridden by a builtin model.] lib/http2.c:507: leaked_storage: Variable "u" going out of scope leaks the storage it points to. Closes curl#6986 * http2: fix a resource leak in push_promise() ... detected by Coverity: Error: RESOURCE_LEAK (CWE-772): lib/http2.c:532: alloc_fn: Storage is returned from allocation function "duphandle". lib/http2.c:532: var_assign: Assigning: "newhandle" = storage returned from "duphandle(data)". lib/http2.c:552: noescape: Resource "newhandle" is not freed or pointed-to in "set_transfer_url". lib/http2.c:555: leaked_storage: Variable "newhandle" going out of scope leaks the storage it points to. Closes curl#6986 * documentation * http: fix the check for 'Authorization' with Bearer The code would wrongly check for it using an additional colon. Reported-by: Blake Burkhart Closes curl#6988 * add stream window option for the easy interface * more documentation * http2 only * options are not generated * http2 only Co-authored-by: Steinwender Wolfgang <wsteinwender@pcs.com> Co-authored-by: Kamil Dudka <kdudka@redhat.com> Co-authored-by: Daniel Stenberg <daniel@haxx.se>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The code would wrongly check for it using an additional colon.
Reported-by: Blake Burkhart