mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-11-27 05:50:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

multi.c: Avoid invalid memory read after free() from commit 3c8c873252

Browse Source 
As the current element in the list is free()d by Curl_llist_remove(),
when the associated connection is pending, reworked the loop to avoid
accessing the next element through e->next afterward.
This commit is contained in:
Steve Holme 2014-09-07 07:09:14 +01:00
parent c25cd9094b
commit 4a6fa4c204
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/multi.c
View File

@ -2779,17 +2779,23 @@ struct curl_llist *Curl_multi_pipelining_server_bl(struct Curl_multi *multi)
void Curl_multi_process_pending_handles(struct Curl_multi *multi)
{
struct curl_llist_element *e;
struct curl_llist_element *e = multi->pending->head;
for(e = multi->pending->head; e; e = e->next) {
while(e) {
struct SessionHandle *data = e->ptr;
struct curl_llist_element *next = e->next;
if(data->mstate == CURLM_STATE_CONNECT_PEND) {
multistate(data, CURLM_STATE_CONNECT);
/* Remove this node from the list */
Curl_llist_remove(multi->pending, e, NULL);
/* Make sure that the handle will be processed soonish. */
Curl_expire_latest(data, 1);
}
e = next; /* operate on next handle */
}
}