fix: replace unsafe sprintf with snprintf and fix memory leak in curl_get/curl_post

2025-05-29 18:59:25 +00:00
parent 9c7e5e7259
commit aed84c8f00
2 changed files with 7 additions and 3 deletions
@@ -68,7 +68,7 @@ char *curl_post(const char *url, const char *data) {
    curl_easy_setopt(curl, CURLOPT_URL, url);
    headers = curl_slist_append(headers, "Content-Type: application/json");
    char bearer_header[1337];
-    sprintf(bearer_header, "Authorization: Bearer %s", resolve_api_key());
+    snprintf(bearer_header, sizeof(bearer_header), "Authorization: Bearer %s", resolve_api_key());
    headers = curl_slist_append(headers, bearer_header);
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data);
@@ -84,6 +84,7 @@ char *curl_post(const char *url, const char *data) {
    curl_easy_cleanup(curl);
    return response.data;
  }
+  free(response.data);
  return NULL;
 }

@@ -101,7 +102,7 @@ char *curl_get(const char *url) {
    curl_easy_setopt(curl, CURLOPT_URL, url);
    headers = curl_slist_append(headers, "Content-Type: application/json");
    char bearer_header[1337];
-    sprintf(bearer_header, "Authorization: Bearer %s", resolve_api_key());
+    snprintf(bearer_header, sizeof(bearer_header), "Authorization: Bearer %s", resolve_api_key());
    headers = curl_slist_append(headers, bearer_header);
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, WriteCallback);
@@ -112,6 +113,9 @@ char *curl_get(const char *url) {
    }
    curl_slist_free_all(headers);
    curl_easy_cleanup(curl);
+  } else {
+    free(response.data);
+    return NULL;
  }
  return response.data;
 }