multi: forbid curl_easy_pause from within multi socket callback

- there is a risk for a nasty recursive situation

- we avoid certain risks that the pause call changes things so that when
  returning from the callback, the state of some internals is undefined
  and we need to reload which is easy to miss

- we can't think of legitiate use cases for doing this. This is
  basically just the new favorite point for AI and security researchers
  to find hypothetical problems

Closes #22179
This commit is contained in:
Daniel Stenberg 2026-06-25 22:52:07 +02:00
parent d8f9f0a912
commit a6af50c484
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
7 changed files with 33 additions and 21 deletions

View file

@ -147,6 +147,7 @@ static int t758_curlSocketCallback(CURL *curl, curl_socket_t s, int action,
void *userp, void *socketp)
{
struct t758_ReadWriteSockets *sockets = userp;
CURLcode result;
(void)curl;
(void)socketp;
@ -158,6 +159,14 @@ static int t758_curlSocketCallback(CURL *curl, curl_socket_t s, int action,
return -1;
}
/* Pause is forbidden in this callback. This also returns
CURLE_BAD_FUNCTION_ARGUMENT before the connection has been setup. */
result = curl_easy_pause(curl, CURLPAUSE_ALL);
if(!result) {
t758_msg("<- curl_easy_pause should return error!");
return -1;
}
if(action == CURL_POLL_IN || action == CURL_POLL_INOUT)
if(t758_addFd(&sockets->read, s, "read"))
return -1; /* bail out */