6 files changed, 42 insertions, 17 deletions
diff --git a/ChangeLog b/ChangeLog
index 92dd8736..6d8a2840 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Mon Oct  9 22:38:07 CEST 2017
+        Add MHD_free() to allow proper free()-ing of username/password
+        data returned via MHD_digest_auth_get_username() or
+        MHD_basic_auth_get_username_password() on Windows. -CG
 Tue Sep 26 14:00:58 CEST 2017
        Fixing race involving setting "at_limit" flag. -CG
diff --git a/doc/examples/basicauthentication.c b/doc/examples/basicauthentication.c
index 0e13a2ee..88cb79b7 100644
--- a/doc/examples/basicauthentication.c
+++ b/doc/examples/basicauthentication.c
@@ -42,12 +42,13 @@ answer_to_connection (void *cls, struct MHD_Connection *connection,
      return MHD_YES;
    }
  pass = NULL;
-  user = MHD_basic_auth_get_username_password (connection, &pass);
+  user = MHD_basic_auth_get_username_password (connection,
-  fail = ( (user == NULL) ||
+                                               &pass);
+  fail = ( (NULL == user) ||
           (0 != strcmp (user, "root")) ||
-           (0 != strcmp (pass, "pa$$w0rd") ) );  
+           (0 != strcmp (pass, "pa$$w0rd") ) );
-  if (user != NULL) free (user);
+  if (NULL != user) MHD_free (user);
-  if (pass != NULL) free (pass);
+  if (NULL != pass) MHD_free (pass);
  if (fail)
    {
      const char *page = "<html><body>Go away.</body></html>";
diff --git a/doc/libmicrohttpd.texi b/doc/libmicrohttpd.texi
index 05b1f834..2e0f196f 100644
--- a/doc/libmicrohttpd.texi
+++ b/doc/libmicrohttpd.texi
@@ -2342,13 +2342,17 @@ client certificates is presented in the MHD tutorial.
 @node microhttpd-dauth basic
 @section Using Basic Authentication
+@deftypefun {void} MHD_free (void *ptr)
+Free the memory given at @code{ptr}.  Used to free data structures allocated by MHD. Calls @code{free(ptr)}.
+@end deftypefun
 @deftypefun {char *} MHD_basic_auth_get_username_password (struct MHD_Connection *connection, char** password)
 Get the username and password from the basic authorization header sent by the client.
 Return @code{NULL} if no username could be found, a pointer to the username if found.
-If returned value is not @code{NULL}, the value must be @code{free()}'ed.
+If returned value is not @code{NULL}, the value must be @code{MHD_free()}'ed.
 @var{password} reference a buffer to store the password. It can be @code{NULL}.
-If returned value is not @code{NULL}, the value must be @code{free()}'ed.
+If returned value is not @code{NULL}, the value must be @code{MHD_free()}'ed.
 @end deftypefun
 @deftypefun {int} MHD_queue_basic_auth_fail_response (struct MHD_Connection *connection, const char *realm, struct MHD_Response *response)
@@ -2370,7 +2374,7 @@ client with a 401 HTTP status.
 @deftypefun {char *} MHD_digest_auth_get_username (struct MHD_Connection *connection)
 Find and return a pointer to the username value from the request header.
 Return @code{NULL} if the value is not found or header does not exist.
-If returned value is not @code{NULL}, the value must be @code{free()}'ed.
+If returned value is not @code{NULL}, the value must be @code{MHD_free()}'ed.
 @end deftypefun
 @deftypefun int MHD_digest_auth_check (struct MHD_Connection *connection, const char *realm, const char *username, const char *password, unsigned int nonce_timeout)
diff --git a/src/examples/authorization_example.c b/src/examples/authorization_example.c
index d62973a2..d8a88203 100644
--- a/src/examples/authorization_example.c
+++ b/src/examples/authorization_example.c
@@ -70,8 +70,11 @@ ahc_echo (void *cls,
  /* require: "Aladdin" with password "open sesame" */
  pass = NULL;
-  user = MHD_basic_auth_get_username_password (connection, &pass);
+  user = MHD_basic_auth_get_username_password (connection,
-  fail = ( (user == NULL) || (0 != strcmp (user, "Aladdin")) || (0 != strcmp (pass, "open sesame") ) );
+                                               &pass);
+  fail = ( (NULL == user) ||
+           (0 != strcmp (user, "Aladdin")) ||
+           (0 != strcmp (pass, "open sesame") ) );
  if (fail)
  {
      response = MHD_create_response_from_buffer (strlen (DENIED),
@@ -87,9 +90,9 @@ ahc_echo (void *cls,
      ret = MHD_queue_response (connection, MHD_HTTP_OK, response);
    }
  if (NULL != user)
-    free (user);
+    MHD_free (user);
  if (NULL != pass)
-    free (pass);
+    MHD_free (pass);
  MHD_destroy_response (response);
  return ret;
 }
diff --git a/src/examples/digest_auth_example.c b/src/examples/digest_auth_example.c
index 4b00669f..889967fb 100644
--- a/src/examples/digest_auth_example.c
+++ b/src/examples/digest_auth_example.c
@@ -54,7 +54,7 @@ ahc_echo (void *cls,
  (void)ptr;               /* Unused. Silent compiler warning. */
  username = MHD_digest_auth_get_username(connection);
-  if (username == NULL)
+  if (NULL == username)
    {
      response = MHD_create_response_from_buffer(strlen (DENIED),
                                                 DENIED,
@@ -70,7 +70,7 @@ ahc_echo (void *cls,
                              username,
                              password,
                              300);
-  free(username);
+  MHD_free (username);
  if ( (ret == MHD_INVALID_NONCE) ||
       (ret == MHD_NO) )
    {
@@ -93,6 +93,7 @@ ahc_echo (void *cls,
  return ret;
 }
 int
 main (int argc, char *const *argv)
 {
diff --git a/src/include/microhttpd.h b/src/include/microhttpd.h
index ac8af8b9..c2a9d32b 100644
--- a/src/include/microhttpd.h
+++ b/src/include/microhttpd.h
@@ -3106,7 +3106,7 @@ MHD_destroy_post_processor (struct MHD_PostProcessor *pp);
 *
 * @param connection The MHD connection structure
 * @return NULL if no username could be found, a pointer
- *                      to the username if found
+ *                      to the username if found, free using #MHD_free().
 * @ingroup authentication
 */
 _MHD_EXTERN char *
@@ -3114,6 +3114,17 @@ MHD_digest_auth_get_username (struct MHD_Connection *connection);
 /**
+ * Free the memory given by @a ptr. Calls "free(ptr)".  This function
+ * should be used to free the username returned by
+ * #MHD_digest_auth_get_username().
+ *
+ * @param ptr pointer to free.
+ */
+void
+MHD_free (void *ptr);
+/**
 * Authenticates the authorization header sent by the client
 *
 * @param connection The MHD connection structure
@@ -3160,9 +3171,9 @@ MHD_queue_auth_fail_response (struct MHD_Connection *connection,
 * Get the username and password from the basic authorization header sent by the client
 *
 * @param connection The MHD connection structure
- * @param password a pointer for the password
+ * @param[out] password a pointer for the password, free using #MHD_free().
 * @return NULL if no username could be found, a pointer
- *                      to the username if found
+ *                      to the username if found, free using #MHD_free().
 * @ingroup authentication
 */
 _MHD_EXTERN char *