romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-01 06:18:04 +03:00
Code Issues Projects Releases Packages Wiki Activity

Curl_easy: remember last connection by id, not by pointer

Browse source 
CVE-2020-8231

Bug: https://curl.haxx.se/docs/CVE-2020-8231.html

Reported-by: Marc Aldorasi
Closes #5824
This commit is contained in:
Daniel Stenberg 2020-08-16 11:34:35 +02:00
parent 687908c6e6
commit 3c9e021f86
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 18 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/multi.c
View file

@ -455,6 +455,7 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
data->state.conn_cache = &data->share->conn_cache;
else
data->state.conn_cache = &multi->conn_cache;
data->state.lastconnect_id = -1;
#ifdef USE_LIBPSL
/* Do the same for PSL. */
@ -677,11 +678,11 @@ static CURLcode multi_done(struct Curl_easy *data,
CONNCACHE_UNLOCK(data);
if(Curl_conncache_return_conn(data, conn)) {
/* remember the most recently used connection */
data->state.lastconnect = conn;
data->state.lastconnect_id = conn->connection_id;
infof(data, "%s\n", buffer);
}
else
data->state.lastconnect = NULL;
data->state.lastconnect_id = -1;
}
Curl_safefree(data->state.buffer);
@ -693,7 +694,7 @@ static int close_connect_only(struct connectdata *conn, void *param)
{
struct Curl_easy *data = param;
if(data->state.lastconnect != conn)
if(data->state.lastconnect_id != conn->connection_id)
return 0;
if(conn->data != data)
@ -805,7 +806,7 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
/* Remove the association between the connection and the handle */
Curl_detach_connnection(data);
if(data->state.lastconnect) {
if(data->state.lastconnect_id != -1) {
/* Mark any connect-only connection for closure */
Curl_conncache_foreach(data, data->state.conn_cache,
data, &close_connect_only);