Commit bcb19883 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

TFTP: fix crash on time-out 

tftp_done() can get called with its TFTP state pointer still being NULL
on an early time-out, which caused a segfault when dereferenced.

Reported-by: Glenn Sheridan
Bug: http://curl.haxx.se/mail/lib-2014-01/0246.html
parent f2e42dd0

lib/tftp.c

+3 −2
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -1041,6 +1041,7 @@ static CURLcode tftp_done(struct connectdata *conn, CURLcode status, 
    return CURLE_ABORTED_BY_CALLBACK;



  /* If we have encountered an error */

  if(state)

    code = tftp_translate_code(state->error);



  return code;