romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-10 05:37:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

multi_ev: refresh sock entry after remove callback

Browse source 
This was missed in the fix for CVE-2026-9080.

Reported-by: stze on hackerone
URL: https://hackerone.com/reports/3823985
Closes #22163
This commit is contained in:
Stefan Eissing 2026-06-25 10:19:17 +02:00 • committed by Daniel Stenberg
parent f746780a1e
commit e9a2b0dc72
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/multi_ev.c
View file

@ -213,7 +213,11 @@ static CURLMcode mev_forget_socket(struct Curl_multi *multi,
rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
multi->socket_userp, entry->user_data);
mev_in_callback(multi, FALSE);
entry->announced = FALSE;
/* curl_easy_pause() is documented as callable from any callback; it
* re-enters mev_assess() which may free this 'entry'. Re-fetch. */
entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
if(entry)
entry->announced = FALSE;
}
mev_sh_entry_kill(multi, s);