Fix oss-fuzz 67167.

Leak on startup and reload only, assuming a corrupt password file provided by the admin. Minimal impact.
eclipse-mosquitto · Mar 2, 2024 · 34e0718 · 34e0718
1 parent f39ecb3
commit 34e0718
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/common/password_mosq.c b/common/password_mosq.c
@@ -436,6 +436,7 @@ static int pw__decode_sha512(struct mosquitto_pw *pw, const char *salt_password)
 	rc = base64__decode(salt_b64, &salt, &salt_len);
 	if(rc != MOSQ_ERR_SUCCESS || (salt_len != 12 && salt_len != HASH_LEN)){
 		free(sp_heap);
+		free(salt);
 		return MOSQ_ERR_INVAL;
 	}
 	memcpy(pw->params.sha512.salt, salt, salt_len);