curl/curl
1
1
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-09-21 03:22:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

pipeline: Sanity check pipeline pointer before accessing it.

Browse Source 
I got a crash with this stack:

curl/lib/url.c:2873 (Curl_removeHandleFromPipeline)
curl/lib/url.c:2919 (Curl_getoff_all_pipelines)
curl/lib/multi.c:561 (curl_multi_remove_handle)
curl/lib/url.c:415 (Curl_close)
curl/lib/easy.c:859 (curl_easy_cleanup)

Closes #704
This commit is contained in:
Anders Bakken 2016-03-07 11:38:26 -08:00 committed by Daniel Stenberg
parent 7e8b65c00b
commit 46bf7ff78d
2 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/pipeline.c
View File

@ -323,10 +323,11 @@ CURLMcode Curl_pipeline_set_server_blacklist(char **servers,
static bool pipe_head(struct SessionHandle *data, static bool pipe_head(struct SessionHandle *data,
struct curl_llist *pipeline) struct curl_llist *pipeline)
{ {
struct curl_llist_element *curr = pipeline->head; if(pipeline) {
if(curr) struct curl_llist_element *curr = pipeline->head;
return (curr->ptr == data) ? TRUE : FALSE; if(curr)
return (curr->ptr == data) ? TRUE : FALSE;
}
return FALSE; return FALSE;
} }

16
lib/url.c
View File

@ -2868,15 +2868,17 @@ static bool IsPipeliningPossible(const struct SessionHandle *handle,
int Curl_removeHandleFromPipeline(struct SessionHandle *handle, int Curl_removeHandleFromPipeline(struct SessionHandle *handle,
struct curl_llist *pipeline) struct curl_llist *pipeline)
{ {
struct curl_llist_element *curr; if(pipeline) {
struct curl_llist_element *curr;
curr = pipeline->head; curr = pipeline->head;
while(curr) { while(curr) {
if(curr->ptr == handle) { if(curr->ptr == handle) {
Curl_llist_remove(pipeline, curr, NULL); Curl_llist_remove(pipeline, curr, NULL);
return 1; /* we removed a handle */ return 1; /* we removed a handle */
}
curr = curr->next;
} }
curr = curr->next;
} }
return 0; return 0;