romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 10:23:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

multi: forbid curl_easy_pause from within multi socket callback

Browse source 
- there is a risk for a nasty recursive situation

- we avoid certain risks that the pause call changes things so that when
  returning from the callback, the state of some internals is undefined
  and we need to reload which is easy to miss

- we can't think of legitiate use cases for doing this. This is
  basically just the new favorite point for AI and security researchers
  to find hypothetical problems

Closes #22179
This commit is contained in:
Daniel Stenberg 2026-06-25 22:52:07 +02:00
parent d8f9f0a912
commit a6af50c484
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
7 changed files with 33 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

13
lib/multi_ev.c
View file

@ -34,8 +34,7 @@
#include "uint-spbset.h"
#include "multihandle.h"
static void mev_in_callback(struct Curl_multi *multi, bool value)
static void mev_in_callback(struct Curl_multi *multi, uint8_t value)
{
multi->in_callback = value;
}
@ -209,12 +208,10 @@ static CURLMcode mev_forget_socket(struct Curl_multi *multi,
if(entry->announced && multi->socket_cb) {
NOVERBOSE((void)cause);
CURL_TRC_M(data, "ev %s, call(fd=%" FMT_SOCKET_T ", ev=REMOVE)", cause, s);
mev_in_callback(multi, TRUE);
mev_in_callback(multi, IN_CALLBACK_FORBID_EASY_PAUSE);
rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
multi->socket_userp, entry->user_data);
mev_in_callback(multi, FALSE);
/* curl_easy_pause() is documented as callable from any callback; it
* re-enters mev_assess() which may free this 'entry'. Re-fetch. */
mev_in_callback(multi, IN_CALLBACK_NO);
entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
if(entry)
entry->announced = FALSE;
@ -285,10 +282,10 @@ static CURLMcode mev_sh_entry_update(struct Curl_multi *multi,
CURL_TRC_M(data, "ev update call(fd=%" FMT_SOCKET_T ", ev=%s%s)",
s, (comboaction & CURL_POLL_IN) ? "IN" : "",
(comboaction & CURL_POLL_OUT) ? "OUT" : "");
mev_in_callback(multi, TRUE);
mev_in_callback(multi, IN_CALLBACK_FORBID_EASY_PAUSE);
rc = multi->socket_cb(data, s, comboaction, multi->socket_userp,
entry->user_data);
mev_in_callback(multi, FALSE);
mev_in_callback(multi, IN_CALLBACK_NO);
if(rc == -1) {
multi->dead = TRUE;
return CURLM_ABORTED_BY_CALLBACK;