romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 08:13:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

Curl_easy: remember last connection by id, not by pointer

Browse source 
CVE-2020-8231

Bug: https://curl.haxx.se/docs/CVE-2020-8231.html

Reported-by: Marc Aldorasi
Closes #5824
This commit is contained in:
Daniel Stenberg 2020-08-16 11:34:35 +02:00
parent 687908c6e6
commit 3c9e021f86
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 18 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

19
lib/connect.c
View file

@ -1363,15 +1363,15 @@ CURLcode Curl_connecthost(struct connectdata *conn, /* context */
}
struct connfind {
struct connectdata *tofind;
bool found;
long id_tofind;
struct connectdata *found;
};
static int conn_is_conn(struct connectdata *conn, void *param)
{
struct connfind *f = (struct connfind *)param;
if(conn == f->tofind) {
f->found = TRUE;
if(conn->connection_id == f->id_tofind) {
f->found = conn;
return 1;
}
return 0;
@ -1393,21 +1393,22 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
* - that is associated with a multi handle, and whose connection
* was detached with CURLOPT_CONNECT_ONLY
*/
if(data->state.lastconnect && (data->multi_easy || data->multi)) {
struct connectdata *c = data->state.lastconnect;
if((data->state.lastconnect_id != -1) && (data->multi_easy || data->multi)) {
struct connectdata *c;
struct connfind find;
find.tofind = data->state.lastconnect;
find.found = FALSE;
find.id_tofind = data->state.lastconnect_id;
find.found = NULL;
Curl_conncache_foreach(data, data->multi_easy?
&data->multi_easy->conn_cache:
&data->multi->conn_cache, &find, conn_is_conn);
if(!find.found) {
data->state.lastconnect = NULL;
data->state.lastconnect_id = -1;
return CURL_SOCKET_BAD;
}
c = find.found;
if(connp) {
/* only store this if the caller cares for it */
*connp = c;