From 34e07184e008981d0cd7afa847a4b628f3d55131 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Sat, 2 Mar 2024 19:40:45 +0000 Subject: [PATCH] Fix oss-fuzz 67167. Leak on startup and reload only, assuming a corrupt password file provided by the admin. Minimal impact. --- common/password_mosq.c | 1 + 1 file changed, 1 insertion(+) diff --git a/common/password_mosq.c b/common/password_mosq.c index dabe274c..a0ec0a20 100644 --- a/common/password_mosq.c +++ b/common/password_mosq.c @@ -436,6 +436,7 @@ static int pw__decode_sha512(struct mosquitto_pw *pw, const char *salt_password) rc = base64__decode(salt_b64, &salt, &salt_len); if(rc != MOSQ_ERR_SUCCESS || (salt_len != 12 && salt_len != HASH_LEN)){ free(sp_heap); + free(salt); return MOSQ_ERR_INVAL; } memcpy(pw->params.sha512.salt, salt, salt_len);