moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-12 04:25:08 -05:00
Code Issues Releases Wiki Activity

url: fix dangling conn->data pointer

Browse Source 
By masking sure to use the *current* easy handle with extracted
connections from the cache, and make sure to NULLify the ->data pointer
when the connection is put into the cache to make this mistake easier to
detect in the future.

Reported-by: Will Dietz
Fixes #2669
Closes #2672
This commit is contained in:
Daniel Stenberg 2018-06-20 23:00:36 +02:00
parent dfb873e308
commit 2c15693a3c
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
3 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/conncache.c
View File

@ -6,7 +6,7 @@
* \___|\___/|_| \_\_____| * \___|\___/|_| \_\_____|
* *
* Copyright (C) 2012 - 2016, Linus Nielsen Feltzing, <linus@haxx.se> * Copyright (C) 2012 - 2016, Linus Nielsen Feltzing, <linus@haxx.se>
* Copyright (C) 2012 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. * Copyright (C) 2012 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
* *
* This software is licensed as described in the file COPYING, which * This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms * you should have received as part of this distribution. The terms
@ -451,6 +451,7 @@ bool Curl_conncache_return_conn(struct connectdata *conn)
} }
CONN_LOCK(data); CONN_LOCK(data);
conn->inuse = FALSE; /* Mark the connection unused */ conn->inuse = FALSE; /* Mark the connection unused */
conn->data = NULL; /* no owner */
CONN_UNLOCK(data); CONN_UNLOCK(data);
return (conn_candidate == conn) ? FALSE : TRUE; return (conn_candidate == conn) ? FALSE : TRUE;

6
lib/connect.c
View File

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___ * | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____| * \___|\___/|_| \_\_____|
* *
* Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
* *
* This software is licensed as described in the file COPYING, which * This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms * you should have received as part of this distribution. The terms
@ -1259,9 +1259,11 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
return CURL_SOCKET_BAD; return CURL_SOCKET_BAD;
} }
if(connp) if(connp) {
/* only store this if the caller cares for it */ /* only store this if the caller cares for it */
*connp = c; *connp = c;
c->data = data;
}
return c->sock[FIRSTSOCKET]; return c->sock[FIRSTSOCKET];
} }
else else

2
lib/url.c
View File

@ -965,6 +965,7 @@ static bool extract_if_dead(struct connectdata *conn,
use */ use */
bool dead; bool dead;
conn->data = data;
if(conn->handler->connection_check) { if(conn->handler->connection_check) {
/* The protocol has a special method for checking the state of the /* The protocol has a special method for checking the state of the
connection. Use it to check if the connection is dead. */ connection. Use it to check if the connection is dead. */
@ -979,7 +980,6 @@ static bool extract_if_dead(struct connectdata *conn,
} }
if(dead) { if(dead) {
conn->data = data;
infof(data, "Connection %ld seems to be dead!\n", conn->connection_id); infof(data, "Connection %ld seems to be dead!\n", conn->connection_id);
Curl_conncache_remove_conn(conn, FALSE); Curl_conncache_remove_conn(conn, FALSE);
return TRUE; return TRUE;