summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2018-10-18 15:07:15 +0200
committerDaniel Stenberg <daniel@haxx.se>2018-10-29 08:05:23 +0100
commit81d135d67155c5295b1033679c606165d4e28f3f (patch)
tree4259507845ca5170849c8d02bd4399552b789942
parent9d8dad1a9d79d60e021f0c4e0f66bf5d51fb3c4e (diff)
downloadcurl-81d135d67155c5295b1033679c606165d4e28f3f.tar.gz
Curl_close: clear data->multi_easy on free to avoid use-after-free
Regression from b46cfbc068 (7.59.0) CVE-2018-16840 Reported-by: Brian Carpenter (Geeknik Labs) Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
-rw-r--r--lib/url.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/url.c b/lib/url.c
index 723b89806..0d5a13f99 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -331,10 +331,12 @@ CURLcode Curl_close(struct Curl_easy *data)
and detach this handle from there. */
curl_multi_remove_handle(data->multi, data);
- if(data->multi_easy)
+ if(data->multi_easy) {
/* when curl_easy_perform() is used, it creates its own multi handle to
use and this is the one */
curl_multi_cleanup(data->multi_easy);
+ data->multi_easy = NULL;
+ }
/* Destroy the timeout list that is held in the easy handle. It is
/normally/ done by curl_multi_remove_handle() but this is "just in