CURLGet/CURLPost dereference calloc() and curl_easy_init() results without a NULL check (NULL write/deref under memory pressure or handle-init failure), the curl_multi_add_handle error path frees the request buffers but never curl_easy_cleanups the easy handle, and every POST with a content type leaks its curl_slist headers (libcurl does not take ownership). The goal is to null-check the allocations and free the handle and slist on the right paths.
One null-deref plus two resource leaks in the request lifecycle.
abc/CURL.c:190-196 — req=calloc(...) and req->easy=curl_easy_init() used unchecked; NULL → write/deref.abc/CURL.c:165-185 CURLStart — curl_multi_add_handle != CURLM_OK frees req->url/req but not curl_easy_cleanup(req->easy).abc/CURL.c:216-223 CURLPost — curl_slist content-type headers handed to CURLOPT_HTTPHEADER and never curl_slist_free_all'd (leak per request; code even notes it).None.
Re-verified 2026-07-07 (now dog/abc/CURL.c): all three flaws present, sites re-cited below.
dog/abc/CURL.c:201-202 CURLGetTimed and :217-218 CURLPost — calloc/curl_easy_init (and strdup) still unchecked; add if (!req) return ... and if (!req->easy) { free(req->url); free(req); return CURLFAIL; } before any setopt.dog/abc/CURL.c:181-186 CURLStart — add-handle fail branch still frees req->url/req only; add curl_easy_cleanup(req->easy) (and free req->headers/req->response if allocated).dog/abc/CURL.c:228-235 CURLPost — slist still leaks per request (// Note: headers leak comment at :234); store the slist in CURLreq, curl_slist_free_all in CURLTick's completion cleanup (:152-158) and in the CURLStart fail branch.calloc/curl_easy_init NULL and a failing multi_add_handle; POST-with-content-type leak check under ASan/valgrind.None.