Skip to content

Commit 81d135d

Browse files
committed
Curl_close: clear data->multi_easy on free to avoid use-after-free
Regression from b46cfbc (7.59.0) CVE-2018-16840 Reported-by: Brian Carpenter (Geeknik Labs) Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
1 parent 9d8dad1 commit 81d135d

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

Diff for: lib/url.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -331,10 +331,12 @@ CURLcode Curl_close(struct Curl_easy *data)
331331
and detach this handle from there. */
332332
curl_multi_remove_handle(data->multi, data);
333333

334-
if(data->multi_easy)
334+
if(data->multi_easy) {
335335
/* when curl_easy_perform() is used, it creates its own multi handle to
336336
use and this is the one */
337337
curl_multi_cleanup(data->multi_easy);
338+
data->multi_easy = NULL;
339+
}
338340

339341
/* Destroy the timeout list that is held in the easy handle. It is
340342
/normally/ done by curl_multi_remove_handle() but this is "just in

0 commit comments

Comments
 (0)