Index: clinkc/src/cybergarage/http/chttp_authentication.c
===================================================================
--- clinkc.orig/src/cybergarage/http/chttp_authentication.c	2015-11-10 13:58:05.508373476 +0800
+++ clinkc/src/cybergarage/http/chttp_authentication.c	2015-11-10 13:57:33.717178300 +0800
@@ -733,6 +733,7 @@
 		*	1. first request
 		*	2. client got Amnesia
 		*/
+		free(auth);
 		return HTTP_AUTH_NOT_EXIST;
 	}
 
@@ -743,6 +744,7 @@
 		auth->realm			= cg_http_request_getrealm(httpReq);
 		if(!auth->realm){
 			printf("error: can not get realm");
+			free(auth);
 			return HTTP_AUTH_ERROR;
 		}
 
@@ -750,30 +752,37 @@
 		strcpy(auth->nonce, tmp);
 		if(!auth->nonce){
 			printf("error: can not get nonce");
+			free(auth);
 			return HTTP_AUTH_ERROR;
 		}
 
 		auth->response		= cg_http_request_getresponse(httpReq);
 		if(!auth->response){
 			printf("error: can not get response");
+			free(auth);
 			return HTTP_AUTH_ERROR;
 		}
 
 		auth->username		= cg_http_request_getusername(httpReq);
 		if(!auth->username){
 			printf("error: can not get username");
+			free(auth);
 			return HTTP_AUTH_INVALID_USERNAME;
 		}
 
-		if(strcmp(user, auth->username))
+		if(strcmp(user, auth->username)){
+			free(auth);
 			return HTTP_AUTH_INVALID_USERNAME;
+		}
 
 		while(now != NULL){
 			if(!strcmp(now->clientHost, auth->clientHost)){
 				found = TRUE;
 
-				if(strcmp(now->realm, auth->realm))
+				if(strcmp(now->realm, auth->realm)){
+					free(auth);
 					return HTTP_AUTH_NOT_EXIST;
+				}
 				if(strcmp(now->nonce, auth->nonce))
 					stale = TRUE;
 
@@ -783,8 +792,10 @@
 			now = now->next;
 		}
 
-		if(!found)
+		if(!found){
+			free(auth);
 			return HTTP_AUTH_NOT_EXIST;
+		}
 
 		if(now->qop){
 			tmp 				= cg_http_request_getqop(httpReq);
@@ -794,8 +805,10 @@
 			}
 			else{
 				auth->qop		= tmp;
-				if(strcmp(auth->qop, now->qop))
+				if(strcmp(auth->qop, now->qop)){
+					free(auth);
 					return HTTP_AUTH_NOT_EXIST;
+				}
 			}
 		}
 
@@ -807,8 +820,10 @@
 			}
 			else{
 				auth->algorithm	= tmp;
-				if(strcmp(auth->algorithm, now->algorithm))
+				if(strcmp(auth->algorithm, now->algorithm)){
+					free(auth);
 					return HTTP_AUTH_NOT_EXIST;
+				}
 			}
 		}
 
@@ -817,12 +832,15 @@
 			if(!tmp){
 				auth->opaque	= NULL;
 				printf("error: can not get opaque");
+				free(auth);
 				return HTTP_AUTH_ERROR;
 			}
 			else{
 				auth->opaque	= tmp;
-				if(strcmp(auth->opaque, now->opaque))
+				if(strcmp(auth->opaque, now->opaque)){
+					free(auth);
 					return HTTP_AUTH_NOT_EXIST;
+				}
 			}
 		}
 
@@ -881,6 +899,7 @@
 		if (!(auth->qop)) {
 			if((auth->algorithm)&&(strcmp(auth->algorithm, "MD5") != 0)){
 				auth->result = AUTH_UNSUPPORT_ALGORITHM;
+				free(auth);
 				return HTTP_AUTH_NOT_EXIST;
 			}
 			snprintf(md5Input, sizeof(md5Input), "%s:%s:%s", ha1, auth->nonce, ha2);
@@ -889,6 +908,7 @@
 		else{
 			if((auth->algorithm)&&(strcmp(auth->algorithm, "MD5") != 0)&&(strcmp(auth->algorithm,"MD5-sess") != 0)){
 				auth->result = AUTH_UNSUPPORT_ALGORITHM;
+				free(auth);
 				return HTTP_AUTH_NOT_EXIST;
 			}
 
@@ -915,16 +935,22 @@
 			cg_str2md5(md5Input,digest);
 		}
 
-		if(!strcmp(digest, auth->response))
+		if(!strcmp(digest, auth->response)){
+			free(auth);
 			return HTTP_AUTH_SUCCESS;
-		else
+		}
+		else{
+			free(auth);
 			return HTTP_AUTH_INVALID_PASSWORD;
+		}
 	}
 	else{
 		printf("invalid authenticcation method\n");
+		free(auth);
 		return HTTP_AUTH_NOT_EXIST;
 	}
 
+	free(auth);
 	return HTTP_AUTH_NOT_EXIST;
 }