romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 09:07:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

conn: fix hostname move on connection reuse

Browse source 
When reusing a connection, the `host` and `conn_to_host` hostname
structs are moved from the template connection onto the existing one.

There was a NULLing of a tempplate member missing in `conn_to_host`
which could then lead to a double free.

Make this struct move into a static function, doing the correct
thing for both `struct hostname` in a connection.

Reported-by: Joshua Rogers
Closes #18995
This commit is contained in:
Stefan Eissing 2025-10-10 09:48:52 +02:00 • committed by Daniel Stenberg
parent 9d7b532404
commit bf41be6292
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/url.c
View file

@ -3286,6 +3286,14 @@ static CURLcode resolve_server(struct Curl_easy *data,
return CURLE_OK;
}
static void url_move_hostname(struct hostname *dest, struct hostname *src)
{
Curl_safefree(dest->rawalloc);
Curl_free_idnconverted_hostname(dest);
*dest = *src;
memset(src, 0, sizeof(*src));
}
/*
* Cleanup the connection `temp`, just allocated for `data`, before using the
* previously `existing` one for `data`. All relevant info is copied over
@ -3340,15 +3348,9 @@ static void reuse_conn(struct Curl_easy *data,
* used the original hostname in SNI to negotiate? Do we send
* requests for another host through the different SNI?
*/
Curl_free_idnconverted_hostname(&existing->host);
Curl_free_idnconverted_hostname(&existing->conn_to_host);
Curl_safefree(existing->host.rawalloc);
Curl_safefree(existing->conn_to_host.rawalloc);
existing->host = temp->host;
temp->host.rawalloc = NULL;
temp->host.encalloc = NULL;
existing->conn_to_host = temp->conn_to_host;
temp->conn_to_host.rawalloc = NULL;
url_move_hostname(&existing->host, &temp->host);
url_move_hostname(&existing->conn_to_host, &temp->conn_to_host);
existing->conn_to_port = temp->conn_to_port;
existing->remote_port = temp->remote_port;
free(existing->hostname_resolve);