block/curl: free s->password in cleanup paths
When password-secret is used, curl_open() resolves it with qcrypto_secret_lookup_as_utf8() and stores the returned buffer in s->password. Unlike s->proxypassword, s->password is not freed either in the open failure path or in curl_close(), so the resolved secret leaks once it has been allocated. Free s->password in both cleanup paths. Fixes: 1bff96064290 ('curl: add support for HTTP authentication parameters') Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn> Message-ID: <20260320063016.262954-1-zhaoguohan_salmon@163.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
GuoHan Zhao committed
Mar 20, 2026 at 14:30 UTC
51fc8443c122fedf4d4891bbc3a1ff25dd8bacdf
1 file changed
+2
block/curl.c
+2
@@ -903,6 +903,7 @@ out_noclean:
903
g_free(s->cookie);
904
g_free(s->url);
905
g_free(s->username);
906
+ g_free(s->password);
907
g_free(s->proxyusername);
908
g_free(s->proxypassword);
909
if (s->sockets) {
@@ -1014,6 +1015,7 @@ static void curl_close(BlockDriverState *bs)
1015
g_free(s->cookie);
1016
g_free(s->url);
1017
g_free(s->username);
1018
+ g_free(s->password);
1019
g_free(s->proxyusername);
1020
g_free(s->proxypassword);
1021
}