moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-24 17:18:48 -05:00
Code Issues Releases Wiki Activity

extract_if_dead: follow-up to 54b201b48c

Browse Source 
extract_if_dead() dead is called from two functions, and only one of
them should get conn->data updated and now neither call path clears it.

scan-build found a case where conn->data would be NULL dereferenced in
ConnectionExists() otherwise.

Closes #3473
This commit is contained in:
Daniel Stenberg 2019-01-15 00:06:26 +01:00
parent fe71b2d928
commit bbae24c3ae
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/url.c
View File

@ -965,9 +965,7 @@ static bool extract_if_dead(struct connectdata *conn,
/* The protocol has a special method for checking the state of the /* The protocol has a special method for checking the state of the
connection. Use it to check if the connection is dead. */ connection. Use it to check if the connection is dead. */
unsigned int state; unsigned int state;
conn->data = data; /* temporary transfer for this connection to use */
state = conn->handler->connection_check(conn, CONNCHECK_ISDEAD); state = conn->handler->connection_check(conn, CONNCHECK_ISDEAD);
conn->data = NULL; /* clear transfer again */
dead = (state & CONNRESULT_DEAD); dead = (state & CONNRESULT_DEAD);
} }
else { else {
@ -996,6 +994,7 @@ struct prunedead {
static int call_extract_if_dead(struct connectdata *conn, void *param) static int call_extract_if_dead(struct connectdata *conn, void *param)
{ {
struct prunedead *p = (struct prunedead *)param; struct prunedead *p = (struct prunedead *)param;
conn->data = p->data; /* transfer to use for this check */
if(extract_if_dead(conn, p->data)) { if(extract_if_dead(conn, p->data)) {
/* stop the iteration here, pass back the connection that was extracted */ /* stop the iteration here, pass back the connection that was extracted */
p->extracted = conn; p->extracted = conn;