Unverified Commit bb2444b7 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

multi: Dereference of null pointer 

Mostly a false positive, but this makes the code easier to read anyway.

Detected by scan-build.

Closes #3563
parent 59e043c5

lib/multi.c

+10 −14
Original line number Diff line number Diff line
@@ -999,11 +999,11 @@ CURLMcode Curl_multi_wait(struct Curl_multi *multi, 
  unsigned int i;

  unsigned int nfds = 0;

  unsigned int curlfds;

  struct pollfd *ufds = NULL;

  bool ufds_malloc = FALSE;

  long timeout_internal;

  int retcode = 0;

  struct pollfd a_few_on_stack[NUM_POLLS_ON_STACK];

  struct pollfd *ufds = &a_few_on_stack[0];



  if(gotsocket)

    *gotsocket = FALSE;
@@ -1048,7 +1048,6 @@ CURLMcode Curl_multi_wait(struct Curl_multi *multi, 
  curlfds = nfds; /* number of internal file descriptors */

  nfds += extra_nfds; /* add the externally provided ones */



  if(nfds) {

  if(nfds > NUM_POLLS_ON_STACK) {

    /* 'nfds' is a 32 bit value and 'struct pollfd' is typically 8 bytes

       big, so at 2^29 sockets this value might wrap. When a process gets
@@ -1059,9 +1058,6 @@ CURLMcode Curl_multi_wait(struct Curl_multi *multi, 
      return CURLM_OUT_OF_MEMORY;

    ufds_malloc = TRUE;

  }

    else

      ufds = &a_few_on_stack[0];

  }

  nfds = 0;



  /* only do the second loop if we found descriptors in the first stage run