[PATCH] http: prevent segfault during curl handle reuse
From: Nick Hengeveld <hidden>
Date: 2016-06-15 22:42:28
Subsystem:
the rest · Maintainer:
Linus Torvalds
If a curl handle is configured with special options, they may reference information that is freed after the request is complete which can cause a segfault if the curl handle is reused for a different type of request. This patch resets these options to a safe state when a transfer slot is assigned to a new request. Signed-off-by: Nick Hengeveld <redacted> --- http.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/http.c b/http.c
index 0cb42a8..146cf7b 100644
--- a/http.c
+++ b/http.c@@ -25,7 +25,6 @@ long curl_low_speed_limit = -1; long curl_low_speed_time = -1; struct curl_slist *pragma_header; -struct curl_slist *no_range_header; struct active_request_slot *active_queue_head = NULL;
@@ -208,7 +207,6 @@ void http_init(void) curl_global_init(CURL_GLOBAL_ALL); pragma_header = curl_slist_append(pragma_header, "Pragma: no-cache"); - no_range_header = curl_slist_append(no_range_header, "Range:"); #ifdef USE_CURL_MULTI {
@@ -344,9 +342,14 @@ #endif slot->finished = NULL; slot->callback_data = NULL; slot->callback_func = NULL; + curl_easy_setopt(slot->curl, CURLOPT_HTTPHEADER, NULL); curl_easy_setopt(slot->curl, CURLOPT_HTTPHEADER, pragma_header); - curl_easy_setopt(slot->curl, CURLOPT_HTTPHEADER, no_range_header); curl_easy_setopt(slot->curl, CURLOPT_ERRORBUFFER, curl_errorstr); + curl_easy_setopt(slot->curl, CURLOPT_CUSTOMREQUEST, NULL); + curl_easy_setopt(slot->curl, CURLOPT_READFUNCTION, NULL); + curl_easy_setopt(slot->curl, CURLOPT_WRITEFUNCTION, NULL); + curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0); + curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1); return slot; }
--
1.3.3.g2186-dirty