diff options
author | Seonah Moon <seonah1.moon@samsung.com> | 2020-01-14 12:57:23 +0900 |
---|---|---|
committer | Seonah Moon <seonah1.moon@samsung.com> | 2020-01-14 12:57:30 +0900 |
commit | 2bc404e2483a44682b92f805bffe056b77a61800 (patch) | |
tree | 61eadf897e5d6d3bfbcb3fc22a659cc03edc04b8 | |
parent | 6356fec82b754d29234d04927e0538ddf4b91569 (diff) | |
download | curl-accepted/tizen_4.0_base.tar.gz curl-accepted/tizen_4.0_base.tar.bz2 curl-accepted/tizen_4.0_base.zip |
Curl_close: clear data->multi_easy on free to avoid use-after-freesubmit/tizen_4.0_base/20200116.015045accepted/tizen/4.0/base/20200117.010705tizen_4.0_baseaccepted/tizen_4.0_base
Regression from b46cfbc (7.59.0)
CVE-2018-16840
Reported-by: Brian Carpenter (Geeknik Labs)
Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
Change-Id: I32bebd2dec9846a2176b1eb0d92ae473b3c01f83
-rw-r--r-- | lib/url.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -409,10 +409,12 @@ CURLcode Curl_close(struct Curl_easy *data) and detach this handle from there. */ curl_multi_remove_handle(data->multi, data); - if(data->multi_easy) + if(data->multi_easy) { /* when curl_easy_perform() is used, it creates its own multi handle to use and this is the one */ curl_multi_cleanup(data->multi_easy); + data->multi_easy = NULL; + } /* Destroy the timeout list that is held in the easy handle. It is /normally/ done by curl_multi_remove_handle() but this is "just in |