diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2020-01-27 22:50:33 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2020-01-28 13:00:41 +0100 |
| commit | db9af34634e36d34067fff506915dcf7a783a1e2 (patch) | |
| tree | 2235a562af9541a8998474d645862f3c2b7faed2 /lib/multi.c | |
| parent | 8b7fff3311fd0caaf9e385bafedeb13f6ac2e161 (diff) | |
| download | curl-db9af34634e36d34067fff506915dcf7a783a1e2.tar.gz | |
multi_done: if multiplexed, make conn->data point to another transfer
... since the current transfer is being killed. Setting to NULL is
wrong, leaving it pointing to 'data' is wrong since that handle might be
about to get freed.
Fixes #4845
Closes #4858
Reported-by: dmitrmax on github
Diffstat (limited to 'lib/multi.c')
| -rw-r--r-- | lib/multi.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/multi.c b/lib/multi.c index b641074d4..6c9d06b0b 100644 --- a/lib/multi.c +++ b/lib/multi.c @@ -592,6 +592,9 @@ static CURLcode multi_done(struct Curl_easy *data, detach_connnection(data); if(CONN_INUSE(conn)) { /* Stop if still used. */ + /* conn->data must not remain pointing to this transfer since it is going + away! Find another to own it! */ + conn->data = conn->easyq.head->ptr; CONN_UNLOCK(data); DEBUGF(infof(data, "Connection still in use %zu, " "no more multi_done now!\n", |