Unverified Commit 81d135d6 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

Curl_close: clear data->multi_easy on free to avoid use-after-free 

Regression from b46cfbc0 (7.59.0)
CVE-2018-16840
Reported-by: Brian Carpenter (Geeknik Labs)

Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
parent 9d8dad1a

lib/url.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -331,10 +331,12 @@ CURLcode Curl_close(struct Curl_easy *data) 
       and detach this handle from there. */

       and detach this handle from there. */

    curl_multi_remove_handle(data->multi, data);

    curl_multi_remove_handle(data->multi, data);





  if(data->multi_easy)

  if(data->multi_easy) {

    /* when curl_easy_perform() is used, it creates its own multi handle to

    /* when curl_easy_perform() is used, it creates its own multi handle to

       use and this is the one */

       use and this is the one */

    curl_multi_cleanup(data->multi_easy);

    curl_multi_cleanup(data->multi_easy);

    data->multi_easy = NULL;

  }





  /* Destroy the timeout list that is held in the easy handle. It is

  /* Destroy the timeout list that is held in the easy handle. It is

     /normally/ done by curl_multi_remove_handle() but this is "just in

     /normally/ done by curl_multi_remove_handle() but this is "just in