From 542c78dda7ff41d9ca6865d705db996fa8ffaf83 Mon Sep 17 00:00:00 2001
From: Daniel Gustafsson <daniel@yesql.se>
Date: Mon, 16 May 2022 21:18:46 +0200
Subject: [PATCH] transfer: Fix potential NULL pointer dereference

Commit 0ef54abf5208 accidentally used the conn variable before the
assertion for it being NULL. Fix by moving the assignment which use
conn to after the assertion.

Closes: #8857
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
---
 lib/transfer.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/transfer.c b/lib/transfer.c
index b76e39a68e..49c9fd62bd 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1896,11 +1896,14 @@ Curl_setup_transfer(
   struct SingleRequest *k = &data->req;
   struct connectdata *conn = data->conn;
   struct HTTP *http = data->req.p.http;
-  bool httpsending = ((conn->handler->protocol&PROTO_FAMILY_HTTP) &&
-                      (http->sending == HTTPSEND_REQUEST));
+  bool httpsending;
+
   DEBUGASSERT(conn != NULL);
   DEBUGASSERT((sockindex <= 1) && (sockindex >= -1));
 
+  httpsending = ((conn->handler->protocol&PROTO_FAMILY_HTTP) &&
+                 (http->sending == HTTPSEND_REQUEST));
+
   if(conn->bits.multiplex || conn->httpversion == 20 || httpsending) {
     /* when multiplexing, the read/write sockets need to be the same! */
     conn->sockfd = sockindex == -1 ?