Skip to content

Pipeline blacklist causes segfault since 7.54.1 #1584

@pterjan

Description

@pterjan

While debugging tests for perl-Net-Curl now failing, I could reproduce it in C:

#include <curl/multi.h>
int main() {
    CURLM *handle = curl_multi_init();
    char * bl[] = {"Microsoft-IIS/6.0", "nginx/0.8.54", NULL};
    curl_multi_setopt(handle, CURLMOPT_PIPELINING_SERVER_BL, bl);
    curl_multi_cleanup(handle);
    return 0;
}
==29767== Invalid free() / delete / delete[] / realloc()
==29767==    at 0x4C29060: free (vg_replace_malloc.c:530)
==29767==    by 0x4E6BCE2: Curl_llist_remove (llist.c:136)
==29767==    by 0x4E6BCE2: Curl_llist_destroy (llist.c:134)
==29767==    by 0x4E87AE1: Curl_pipeline_set_server_blacklist (pipeline.c:272)
==29767==    by 0x4E6D9F3: curl_multi_cleanup (multi.c:2256)
==29767==    by 0x400851: main (in /home/pterjan/co/perl-Net-Curl/BUILD/Net-Curl-0.37/a.out)
==29767==  Address 0x7a7b6c8 is 24 bytes inside a block of size 44 alloc'd
==29767==    at 0x4C27F66: malloc (vg_replace_malloc.c:299)
==29767==    by 0x4E87AA2: Curl_pipeline_set_server_blacklist (pipeline.c:282)
==29767==    by 0x4E6DD53: curl_multi_setopt (multi.c:2719)
==29767==    by 0x400845: main (in /home/pterjan/co/perl-Net-Curl/BUILD/Net-Curl-0.37/a.out)

$ curl -V
curl 7.54.1 (x86_64-mageia-linux-gnu) libcurl/7.54.1 OpenSSL/1.0.2l zlib/1.2.11 libssh2/1.7.0 nghttp2/1.9.2
Release-Date: 2017-06-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy 

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions