Crash when configuring with DNS over HTTPS, but without threading or ares

[larskarlitski]

I did this

I have curl compiled with DNS over HTTPS, but without threads or ares. It crashes while connecting to a name that it found in its DNS cache.

I believe this is due to the easy handle's conn->dns_entry field being NULL. Curl_once_resolved sets it from state.async.dns, but only if CURL_USE_ASYNC is defined (lib/hostip.c:1439):

#ifdef USE_CURL_ASYNC
  if(data->state.async.dns) {
    conn->dns_entry = data->state.async.dns;
    data->state.async.dns = NULL;
  }
#endif

However, state_resolving only sets state.async.dns when CURLRES_ASYNCH is defined (lib/multi.c:2090):

#ifdef CURLRES_ASYNCH
    data->state.async.dns = dns;
    data->state.async.done = TRUE;
#endif

In my configuration, CURLRES_ASYNCH is not set, but USE_CURL_ASYNC is set. Thus, conn->dns_entry stays NULL and curl crashes accessing this field while connecting (in cf_he_connect:973).

lib/urldata.h:566 defines USE_CURL_ASYNC when CURLRES_ASYNCH is defined or when CURL_DISABLE_DOH is not defined.

I don't know curl well enough to suggest a fix, but changing the #ifdef CURLRES_ASYNCH in multi.c to #ifdef USE_CURL_ASYNC works and seems correct from my understanding.

I expected the following

No response

curl/libcurl version

I have seen this with curl 8.12.1 and with latest main as of now (f8e7a4d).

operating system

Linux fedora 6.13.5-200.fc41.aarch64 #1 SMP PREEMPT_DYNAMIC Thu Feb 27 15:30:52 UTC 2025 aarch64 GNU/Linux

[bagder]

What does curl -V show you?

How do you reproduce this crash? I built master with the blocking resolver just now and this works fine:

curl --doh-url https://cloudflare-dns.com/dns-query curl.se -v

[bagder]

Ah right, you said it needs to find the name in the cache. I need a better command line.

[bagder]

This works for me, getting the name from the cache in the second transfer:

curl --doh-url https://cloudflare-dns.com/dns-query curl.se curl.se --http1.0 -vv

[larskarlitski]

Sorry – I should've mentioned that I am using libcurl. Cannot share the code at the moment and did not find time to write a minimal reproducer.

When running with CURL_OPT_VERBOSE, the last message before the crash is Hostname XXX was found in DNS cache.

[bagder]

I could not reproduce, but by reading code I made #16648

(I suspect there might be some other issues still lurking when using the odd combo of blocking resolver + DoH.)

[larskarlitski]

Works like a charm. Thank you for the swift fix!