File curl-CVE-2018-16840.patch of Package curl.24880

Overview Repositories Revisions Requests Users Attributes Meta

File curl-CVE-2018-16840.patch of Package curl.24880

From c6a379a2088884561ad2dc7c12a15cbf1a300c2f Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 18 Oct 2018 15:07:15 +0200
Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
 use-after-free

Regression from b46cfbc068 (7.59.0)

Reported-by: Brian Carpenter (Geeknik Labs)
---
 lib/url.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Index: curl-7.37.0/lib/url.c
===================================================================
--- curl-7.37.0.orig/lib/url.c
+++ curl-7.37.0/lib/url.c
@@ -399,10 +399,12 @@ CURLcode Curl_close(struct SessionHandle
        and detach this handle from there. */
     curl_multi_remove_handle(data->multi, data);
 
-  if(data->multi_easy)
+  if(data->multi_easy) {
     /* when curl_easy_perform() is used, it creates its own multi handle to
        use and this is the one */
     curl_multi_cleanup(data->multi_easy);
+    data->multi_easy = NULL;
+  }
 
   /* Destroy the timeout list that is held in the easy handle. It is
      /normally/ done by curl_multi_remove_handle() but this is "just in

Places

File curl-CVE-2018-16840.patch of Package curl.24880

Places