GuoHan Zhao 51fc8443c1 block/curl: free s->password in cleanup paths ...

When password-secret is used, curl_open() resolves it with
qcrypto_secret_lookup_as_utf8() and stores the returned buffer in
s->password.

Unlike s->proxypassword, s->password is not freed either in the open
failure path or in curl_close(), so the resolved secret leaks once it
has been allocated.

Free s->password in both cleanup paths.

Fixes: 1bff960642 ('curl: add support for HTTP authentication parameters')
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Message-ID: <20260320063016.262954-1-zhaoguohan_salmon@163.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2026-03-24 17:34:49 +01:00

..

export

fuse: Implement multi-threading

2026-03-10 12:12:02 +01:00

monitor

hmp_nbd_server_start: Don't ask for backing image data

2026-03-04 11:47:44 +01:00

accounting.c

qdev: Free property array on release

2026-02-13 11:16:52 +01:00

aio_task.c

block: rename block/aio.h to qemu/aio.h

2025-12-27 10:11:12 +01:00

amend.c

block: Mark BlockDriver callbacks for amend job GRAPH_RDLOCK

2023-05-10 14:16:54 +02:00

backup.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

blkdebug.c

blkdebug: Use error_setg_file_open() for a better error message

2026-01-07 11:26:57 +01:00

blkio.c

include: reorganize memory API headers

2025-12-27 10:11:09 +01:00

blklogwrites.c

bswap: Include missing 'qemu/bswap.h' header

2026-01-22 10:48:45 +01:00

blkreplay.c

blkreplay: Run BH in coroutine’s AioContext

2025-11-18 18:01:55 +01:00

blkverify.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

block-backend.c

include: move hw/qdev-core.h to hw/core/, rename

2025-12-27 10:11:07 +01:00

block-copy.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

block-gen.h

block-coroutine-wrapper.py: support also basic return types

2022-12-15 16:07:43 +01:00

block-ram-registrar.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

bochs.c

block: replace TABs with space

2025-11-11 22:06:09 +01:00

cloop.c

block: Take graph lock for most of .bdrv_open

2023-11-08 17:56:18 +01:00

commit.c

block/commit: mark commit_abort() as GRAPH_UNLOCKED

2025-07-14 15:42:13 +02:00

copy-before-write.c

block: Expand block status mode from bool to flags

2025-05-14 15:33:34 -05:00

copy-before-write.h

blockdev-backup: Add error handling option for copy-before-write jobs

2025-05-12 18:19:31 +03:00

copy-on-read.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

copy-on-read.h

block: Mark bdrv_(un)freeze_backing_chain() and callers GRAPH_RDLOCK

2023-11-07 19:14:19 +01:00

coroutines.h

block: Expand block status mode from bool to flags

2025-05-14 15:33:34 -05:00

create.c

qemu/compiler: Absorb 'clang-tsa.h'

2025-03-06 14:21:25 +01:00

crypto.c

error: Consistently name Error * objects err, and not errp

2026-01-07 11:26:57 +01:00

crypto.h

block: Support detached LUKS header creation using qemu-img

2024-02-09 12:50:37 +00:00

curl.c

block/curl: free s->password in cleanup paths

2026-03-24 17:34:49 +01:00

dirty-bitmap.c

block: Mark bdrv_*_dirty_bitmap() and callers GRAPH_RDLOCK

2023-02-23 19:49:32 +01:00

dmg-bz2.c

Include qemu-common.h exactly where needed

2019-06-12 13:20:20 +02:00

dmg-lzfse.c

block/dmg: Ignore C99 prototype declaration mismatch from <lzfse.h>

2023-03-30 15:03:36 +02:00

dmg.c

block: Protect bs->file with graph_lock

2023-11-08 17:56:18 +01:00

dmg.h

block/dmg: Declare a type definition for DMG uncompress function

2023-04-24 13:53:44 -04:00

file-posix.c

block: Move qemu_fcntl_addfl() into osdep.c

2026-03-10 12:11:43 +01:00

file-win32.c

block/file-win32: Improve an error message

2026-01-08 07:50:32 +01:00

filter-compress.c

block: Take graph lock for most of .bdrv_open

2023-11-08 17:56:18 +01:00

gluster.c

gluster: Do not move coroutine into BDS context

2025-11-18 18:01:50 +01:00

graph-lock.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

io_uring.c

block: rename block/aio.h to qemu/aio.h

2025-12-27 10:11:12 +01:00

io.c

block: Drop use of Stat64

2026-01-17 10:46:42 +11:00

iscsi-opts.c

modules: add block module annotations

2021-07-09 18:20:27 +02:00

iscsi.c

iscsi: Create AIO BH in original AioContext

2025-11-18 18:01:57 +01:00

linux-aio.c

block: rename block/aio.h to qemu/aio.h

2025-12-27 10:11:12 +01:00

meson.build

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

mirror.c

block/mirror: fix assertion failure upon duplicate complete for job using 'replaces'

2026-03-17 12:31:54 +01:00

nbd.c

treewide: handle result of qio_channel_set_blocking()

2025-09-19 12:46:07 +01:00

nfs.c

block/nfs: add support for libnfs v6

2026-03-10 14:33:55 +01:00

null.c

null-aio: Run CB in original AioContext

2025-11-18 18:01:57 +01:00

nvme.c

Revert "nvme: Fix coroutine waking"

2025-12-15 09:50:41 -05:00

parallels-ext.c

bswap: Include missing 'qemu/bswap.h' header

2026-01-22 10:48:45 +01:00

parallels.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

parallels.h

block: Protect bs->file with graph_lock

2023-11-08 17:56:18 +01:00

preallocate.c

block: Protect bs->file with graph_lock

2023-11-08 17:56:18 +01:00

progress_meter.c

coroutine: Clean up superfluous inclusion of qemu/lockable.h

2023-01-19 10:18:28 +01:00

qapi-system.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

qapi.c

block: Wire up 'flat' mode also for 'query-block'

2026-03-04 11:47:44 +01:00

qcow2-bitmap.c

block/qcow2-bitmap: Replace g_memdup() by g_memdup2()

2024-05-08 19:11:34 +02:00

qcow2-cache.c

qcow2: Mark qcow2_signal_corruption() and callers GRAPH_RDLOCK

2023-10-12 16:31:33 +02:00

qcow2-cluster.c

qcow2: put discards in discard queue when discard-no-unref is enabled

2025-11-11 22:06:09 +01:00

qcow2-refcount.c

qcow2: put discards in discard queue when discard-no-unref is enabled

2025-11-11 22:06:09 +01:00

qcow2-snapshot.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

qcow2-threads.c

thread-pool: avoid passing the pool parameter every time

2023-04-25 13:17:28 +02:00

qcow2.c

qcow2: Simplify size round-up in co_create_opts

2026-03-06 17:45:15 +01:00

qcow2.h

bswap: Include missing 'qemu/bswap.h' header

2026-01-22 10:48:45 +01:00

qcow.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

qed-check.c

qed: mark more functions as coroutine_fns and GRAPH_RDLOCK

2023-06-28 09:46:20 +02:00

qed-cluster.c

…

qed-l2-cache.c

osdep: Move memalign-related functions to their own header

2022-03-07 13:16:49 +00:00

qed-table.c

block: use bdrv_co_debug_event in coroutine context

2023-06-28 09:46:34 +02:00

qed.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

qed.h

block: Protect bs->file with graph_lock

2023-11-08 17:56:18 +01:00

quorum.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

raw-format.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

rbd.c

rbd: Run co BH CB in the coroutine’s AioContext

2025-11-18 18:01:50 +01:00

replication.c

block: mark bdrv_reopen_queue() and bdrv_reopen_multiple() as GRAPH_UNLOCKED

2025-07-14 15:42:05 +02:00

reqlist.c

block/reqlist: allow adding overlapping requests

2024-09-30 10:53:18 +03:00

snapshot-access.c

block: Expand block status mode from bool to flags

2025-05-14 15:33:34 -05:00

snapshot.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

ssh.c

ssh: Run restart_coroutine in current AioContext

2025-11-18 18:01:55 +01:00

stream.c

block/stream: mark stream_prepare() as GRAPH_UNLOCKED

2025-07-14 15:42:04 +02:00

throttle-groups.c

throttle-group: Fix race condition in throttle_group_restart_queue()

2026-03-16 16:55:18 +01:00

throttle.c

block: Take graph lock for most of .bdrv_open

2023-11-08 17:56:18 +01:00

trace-events

block/curl: add support for S3 presigned URLs

2026-03-10 15:48:48 +01:00

trace.h

trace: switch position of headers to what Meson requires

2020-08-21 06:18:24 -04:00

vdi.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

vhdx-endian.c

Include qemu-common.h exactly where needed

2019-06-12 13:20:20 +02:00

vhdx-log.c

vhdx: Take locks for accessing bs->file

2023-11-08 17:56:18 +01:00

vhdx.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

vhdx.h

vhdx: Take locks for accessing bs->file

2023-11-08 17:56:18 +01:00

vmdk.c

block/vmdk: fix OOB read in vmdk_read_extent()

2026-03-03 14:45:01 +01:00

vpc.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

vvfat.c

Fix const qualifier build errors with recent glibc

2025-12-09 21:00:15 +01:00

win32-aio.c

block: rename block/aio.h to qemu/aio.h

2025-12-27 10:11:12 +01:00

write-threshold.c

block: remove AioContext locking

2023-12-21 22:49:27 +01:00