[GNUnet-SVN] [gnurl] 50/116: ntlm: avoid malloc(0) for zero length passwords

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit 685ef130575cdcf63fe9547757d88a49a40ef281
Author: Daniel Stenberg <address@hidden>
AuthorDate: Sat Nov 4 16:42:21 2017 +0100

    ntlm: avoid malloc(0) for zero length passwords
    
    It triggers an assert() when built with memdebug since malloc(0) may
    return NULL *or* a valid pointer.
    
    Detected by OSS-Fuzz: 
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4054
    
    Assisted-by: Max Dymond
    Closes #2054
---
 lib/curl_ntlm_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c
index 5154949e6..1309bf0d9 100644
--- a/lib/curl_ntlm_core.c
+++ b/lib/curl_ntlm_core.c
@@ -557,7 +557,7 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct Curl_easy *data,
                                    unsigned char *ntbuffer /* 21 bytes */)
 {
   size_t len = strlen(password);
-  unsigned char *pw = malloc(len * 2);
+  unsigned char *pw = len ? malloc(len * 2) : strdup("");
   CURLcode result;
   if(!pw)
     return CURLE_OUT_OF_MEMORY;

-- 
To stop receiving notification emails like this one, please contact
address@hidden