From 76f33fd373f2d1c9ff8a090a65c254fe7a4a9864 Mon Sep 17 00:00:00 2001 From: Kevin Burke Date: Mon, 26 Apr 2021 15:04:02 -0700 Subject: [PATCH] c-hyper: don't write to set.writeheader if null Previously if a caller set CURLOPT_WRITEFUNCTION but did not set a CURLOPT_HEADERDATA buffer, Hyper would still attempt to write headers to the data->set.writeheader header buffer, even though it is null. This led to NPE segfaults attempting to use libcurl+Hyper with Git, for example. Instead, process the client write for the status line using the same logic we use to process the client write for the later HTTP headers, which contains the appropriate guard logic. As a side benefit, data->set.writeheader is now only read in one file instead of two. Fixes #6619 Fixes abetterinternet/crustls#49 Fixes hyperium/hyper#2438 Closes #6971 --- lib/c-hyper.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/lib/c-hyper.c b/lib/c-hyper.c index a7bee08c4..be5c5b47c 100644 --- a/lib/c-hyper.c +++ b/lib/c-hyper.c @@ -208,8 +208,6 @@ static CURLcode status_line(struct Curl_easy *data, size_t wrote; size_t len; const char *vstr; - curl_write_callback writeheader = - data->set.fwrite_header? data->set.fwrite_header: data->set.fwrite_func; vstr = http_version == HYPER_HTTP_VERSION_1_1 ? "1.1" : (http_version == HYPER_HTTP_VERSION_2 ? "2" : "1.0"); conn->httpversion = @@ -232,12 +230,12 @@ static CURLcode status_line(struct Curl_easy *data, len = Curl_dyn_len(&data->state.headerb); Curl_debug(data, CURLINFO_HEADER_IN, Curl_dyn_ptr(&data->state.headerb), len); - Curl_set_in_callback(data, true); - wrote = writeheader(Curl_dyn_ptr(&data->state.headerb), 1, len, - data->set.writeheader); - Curl_set_in_callback(data, false); - if(wrote != len) - return CURLE_WRITE_ERROR; + result = Curl_client_write(data, CLIENTWRITE_HEADER, + Curl_dyn_ptr(&data->state.headerb), len); + if(result) { + data->state.hresult = CURLE_ABORTED_BY_CALLBACK; + return HYPER_ITER_BREAK; + } data->info.header_size += (long)len; data->req.headerbytecount += (long)len;