romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 18:23:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

multi: shut down CONNECT in Curl_detach_connnection

Browse source 
... to prevent a lingering pointer that would lead to a double-free.

Added test 1939 to verify.

Reported-by: Stephen M. Coakley
Fixes #7982
Closes #7986
This commit is contained in:
Daniel Stenberg 2021-11-10 14:42:04 +01:00
parent 11a46d6d66
commit f0b7099a10
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 138 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/http_proxy.c
View file

@ -198,11 +198,11 @@ static CURLcode connect_init(struct Curl_easy *data, bool reinit)
return CURLE_OK;
}
static void connect_done(struct Curl_easy *data)
void Curl_connect_done(struct Curl_easy *data)
{
struct connectdata *conn = data->conn;
struct http_connect_state *s = conn->connect_state;
if(s->tunnel_state != TUNNEL_EXIT) {
if(s && (s->tunnel_state != TUNNEL_EXIT)) {
s->tunnel_state = TUNNEL_EXIT;
Curl_dyn_free(&s->rcvbuf);
Curl_dyn_free(&s->req);
@ -662,7 +662,7 @@ static CURLcode CONNECT(struct Curl_easy *data,
if(s->close_connection && data->req.newurl) {
conn->bits.proxy_connect_closed = TRUE;
infof(data, "Connect me again please");
connect_done(data);
Curl_connect_done(data);
}
else {
free(data->req.newurl);
@ -974,7 +974,7 @@ static CURLcode CONNECT(struct Curl_easy *data,
if(conn->bits.close && data->req.newurl) {
conn->bits.proxy_connect_closed = TRUE;
infof(data, "Connect me again please");
connect_done(data);
Curl_connect_done(data);
}
else {
free(data->req.newurl);
@ -1048,7 +1048,7 @@ CURLcode Curl_proxyCONNECT(struct Curl_easy *data,
result = CONNECT(data, sockindex, hostname, remote_port);
if(result || Curl_connect_complete(conn))
connect_done(data);
Curl_connect_done(data);
return result;
}

1
lib/multi.c
View file

@ -878,6 +878,7 @@ void Curl_detach_connnection(struct Curl_easy *data)
{
struct connectdata *conn = data->conn;
if(conn) {
Curl_connect_done(data); /* if mid-CONNECT, shut it down */
Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);
Curl_ssl_detach_conn(data, conn);
}