Fix a theoretical memory leak in pg_password_sendauth(). If the first

malloc() succeeded but the second failed, the buffer allocated by the
first malloc() would be leaked. Fix this by allocating both buffers
via a single malloc(), as suggested by Tom.

Per Coverity static analysis performed by EnterpriseDB.

diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
index d9865f2a5f93d5f380c58ca8e235f9425b422a99..c79e38a9363d7fb7f3713e2d4d55b305e3bba57d 100644 (file)
--- a/src/interfaces/libpq/fe-auth.c
+++ b/src/interfaces/libpq/fe-auth.c
@@ -10,7 +10,7 @@
  * exceed INITIAL_EXPBUFFER_SIZE (currently 256 bytes).
  *
  * IDENTIFICATION
- *   $PostgreSQL: pgsql/src/interfaces/libpq/fe-auth.c,v 1.102 2005/06/27 02:04:26 neilc Exp $
+ *   $PostgreSQL: pgsql/src/interfaces/libpq/fe-auth.c,v 1.103 2005/06/30 01:59:20 neilc Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -407,27 +407,27 @@ pg_password_sendauth(PGconn *conn, const char *password, AuthRequest areq)
            {
                char       *crypt_pwd2;
 
-               if (!(crypt_pwd = malloc(MD5_PASSWD_LEN + 1)) ||
-                   !(crypt_pwd2 = malloc(MD5_PASSWD_LEN + 1)))
+               /* Allocate enough space for two MD5 hashes */
+               crypt_pwd = malloc(2 * (MD5_PASSWD_LEN + 1));
+               if (!crypt_pwd)
                {
                    fprintf(stderr, libpq_gettext("out of memory\n"));
                    return STATUS_ERROR;
                }
+
+               crypt_pwd2 = crypt_pwd + MD5_PASSWD_LEN + 1;
                if (!EncryptMD5(password, conn->pguser,
                                strlen(conn->pguser), crypt_pwd2))
                {
                    free(crypt_pwd);
-                   free(crypt_pwd2);
                    return STATUS_ERROR;
                }
                if (!EncryptMD5(crypt_pwd2 + strlen("md5"), conn->md5Salt,
                                sizeof(conn->md5Salt), crypt_pwd))
                {
                    free(crypt_pwd);
-                   free(crypt_pwd2);
                    return STATUS_ERROR;
                }
-               free(crypt_pwd2);
                break;
            }
        case AUTH_REQ_CRYPT: