Skip to content

Commit

Permalink
c-hyper: don't write to set.writeheader if null
Browse files Browse the repository at this point in the history
Previously if a caller set CURLOPT_WRITEFUNCTION but did not set a
CURLOPT_HEADERDATA buffer, Hyper would still attempt to write headers
to the data->set.writeheader header buffer, even though it is null.
This led to NPE segfaults attempting to use libcurl+Hyper with Git,
for example.

Instead, process the client write for the status line using the same
logic we use to process the client write for the later HTTP headers,
which contains the appropriate guard logic. As a side benefit,
data->set.writeheader is now only read in one file instead of two.

Fixes curl#6619.
Fixes rustls/rustls-ffi#49.
Fixes hyperium/hyper#2438.
  • Loading branch information
kevinburke committed Apr 26, 2021
1 parent 9fc2844 commit 2e718ac
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions lib/c-hyper.c
Original file line number Diff line number Diff line change
Expand Up @@ -232,12 +232,12 @@ static CURLcode status_line(struct Curl_easy *data,
len = Curl_dyn_len(&data->state.headerb);
Curl_debug(data, CURLINFO_HEADER_IN, Curl_dyn_ptr(&data->state.headerb),
len);
Curl_set_in_callback(data, true);
wrote = writeheader(Curl_dyn_ptr(&data->state.headerb), 1, len,
data->set.writeheader);
Curl_set_in_callback(data, false);
if(wrote != len)
return CURLE_WRITE_ERROR;
result = Curl_client_write(data, CLIENTWRITE_HEADER,
Curl_dyn_ptr(&data->state.headerb), len);
if(result) {
data->state.hresult = CURLE_ABORTED_BY_CALLBACK;
return HYPER_ITER_BREAK;
}

data->info.header_size += (long)len;
data->req.headerbytecount += (long)len;
Expand Down

0 comments on commit 2e718ac

Please sign in to comment.