-
Notifications
You must be signed in to change notification settings - Fork 0
Description
Hey!
I believe there's a memory leak here in the case where the base64-decoded data does not contain ::
https://github.com/pariahsoft/libvmod-authentication/blob/master/src/vmod_authentication.c#L25-L30
(I would have expected to see a free(c); before the return NULL;)
Also on these lines c is dereferenced before it has been checked if the malloc(sizeof(combination)); succeeded: and an assignment is made to the data at page 0:
https://github.com/pariahsoft/libvmod-authentication/blob/master/src/vmod_authentication.c#L33-L34
on a general note, strdup and strndup and friends are not verified to be successful allocations before being used.
Also, the base64_decode function is called twice on the input:
https://github.com/pariahsoft/libvmod-authentication/blob/master/src/vmod_authentication.c#L63-L70 (base64_decode_alloc also performs the decoding: https://github.com/pariahsoft/libvmod-authentication/blob/master/src/base64.c#L414)
Also, I believe this should be return false;? https://github.com/pariahsoft/libvmod-authentication/blob/master/src/base64.c#L412