From facdb12ffd64e1d9a3635ceb9781f440080887ba45b1b4c81e7d5284407a97e6 Mon Sep 17 00:00:00 2001
From: ADAM David Alan Martin <adam@recursive.engineer>
Date: Tue, 5 May 2026 21:50:14 -0400
Subject: [PATCH] OpenSSL's `Server_t` owns its hostname string.

---
 src/IO/tls_openssl.cc | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/src/IO/tls_openssl.cc b/src/IO/tls_openssl.cc
index 2c44fea..0e22874 100644
--- a/src/IO/tls_openssl.cc
+++ b/src/IO/tls_openssl.cc
@@ -69,7 +69,7 @@ using namespace std::literals::string_literals;
 
 
 struct Server_t {
-   char *hostname;
+   std::string hostname;
    int port;
    int cert_status;
 };
@@ -372,7 +372,7 @@ static int Tls_save_certificate_home(X509 * cert)
 static int Tls_servers_cmp(const void *v1, const void *v2)
 {
    const Server_t *s1 = (const Server_t *)v1, *s2 = (const Server_t *)v2;
-   int cmp = dStrAsciiCasecmp(s1->hostname, s2->hostname);
+   int cmp = dStrAsciiCasecmp(s1->hostname.c_str(), s2->hostname.c_str());
 
    if (!cmp)
       cmp = s1->port - s2->port;
@@ -386,7 +386,7 @@ static int Tls_servers_by_url_cmp(const void *v1, const void *v2)
    const Server_t *s = (const Server_t *)v1;
    const DilloUrl *url = (const DilloUrl *)v2;
 
-   int cmp = dStrAsciiCasecmp(s->hostname, URL_HOST(url));
+   int cmp = dStrAsciiCasecmp(s->hostname.c_str(), URL_HOST(url));
 
    if (!cmp)
       cmp = s->port - URL_PORT(url);
@@ -419,7 +419,7 @@ int a_Tls_openssl_connect_ready(const DilloUrl *url)
    } else {
       s = std::make_unique< Server_t >().release();
 
-      s->hostname = dStrdup(URL_HOST(url));
+      s->hostname = URL_HOST(url);
       s->port = URL_PORT(url);
       s->cert_status = CERT_STATUS_RECEIVING;
       dList_insert_sorted(servers, s, Tls_servers_cmp);
@@ -844,7 +844,7 @@ static int Tls_examine_certificate(SSL *ssl, Server_t *srv)
    const uint_t buflen = 4096;
    char buf[buflen], *cn;
    int choice = -1, ret = -1;
-   const std::string title = "Flenser TLS security warning: "s + srv->hostname;
+   const std::string title = "Flenser TLS security warning: " + srv->hostname;
 
 #if OPENSSL_VERSION_NUMBER < 0x30000000L
    remote_cert = SSL_get_peer_certificate(ssl);
@@ -864,7 +864,7 @@ static int Tls_examine_certificate(SSL *ssl, Server_t *srv)
          ret = 0;
       }
    } else if (Tls_check_cert_strength(ssl, srv, &choice) &&
-              Tls_check_cert_hostname(remote_cert, srv->hostname, &choice)) {
+              Tls_check_cert_hostname(remote_cert, srv->hostname.c_str(), &choice)) {
       /* Figure out if (and why) the remote system can't be trusted */
       st = SSL_get_verify_result(ssl);
 	 X509_NAME *subject_name = NULL;
@@ -1379,7 +1379,6 @@ static void Tls_servers_freeall(void)
 
       for (i = 0; i < n; i++) {
          std::unique_ptr< Server_t > s { reinterpret_cast< Server_t *  >( dList_nth_data(servers, i) ) };
-         dFree(s->hostname);
       }
       dList_free(servers);
    }