Commit 46bf7ff7 authored by Anders Bakken's avatar Anders Bakken Committed by Daniel Stenberg
Browse files

pipeline: Sanity check pipeline pointer before accessing it. 

I got a crash with this stack:

curl/lib/url.c:2873 (Curl_removeHandleFromPipeline)
curl/lib/url.c:2919 (Curl_getoff_all_pipelines)
curl/lib/multi.c:561 (curl_multi_remove_handle)
curl/lib/url.c:415 (Curl_close)
curl/lib/easy.c:859 (curl_easy_cleanup)

Closes #704
parent 7e8b65c0

lib/pipeline.c

+5 −4
Original line number Diff line number Diff line
@@ -323,10 +323,11 @@ CURLMcode Curl_pipeline_set_server_blacklist(char **servers, 
static bool pipe_head(struct SessionHandle *data,

                      struct curl_llist *pipeline)

{

  if(pipeline) {

    struct curl_llist_element *curr = pipeline->head;

    if(curr)

      return (curr->ptr == data) ? TRUE : FALSE;



  }

  return FALSE;

}

lib/url.c

+9 −7
Original line number Diff line number Diff line
@@ -2868,6 +2868,7 @@ static bool IsPipeliningPossible(const struct SessionHandle *handle, 
int Curl_removeHandleFromPipeline(struct SessionHandle *handle,

                                  struct curl_llist *pipeline)

{

  if(pipeline) {

    struct curl_llist_element *curr;



    curr = pipeline->head;
@@ -2878,6 +2879,7 @@ int Curl_removeHandleFromPipeline(struct SessionHandle *handle, 
      }

      curr = curr->next;

    }

  }



  return 0;

}