[118720] trunk/base/src/pextlib1.0/curl.c

[cal at macports.org]

Revision: 118720
          https://trac.macports.org/changeset/118720
Author:   cal at macports.org
Date:     2014-04-08 18:40:14 -0700 (Tue, 08 Apr 2014)
Log Message:
-----------
base: move curl_multi_remove_handle after the use of the return value of curl_multi_info_read() to prevent a use-after-free.

Modified Paths:
--------------
    trunk/base/src/pextlib1.0/curl.c

Modified: trunk/base/src/pextlib1.0/curl.c
===================================================================
--- trunk/base/src/pextlib1.0/curl.c	2014-04-09 01:08:59 UTC (rev 118719)
+++ trunk/base/src/pextlib1.0/curl.c	2014-04-09 01:40:14 UTC (rev 118720)
@@ -163,6 +163,7 @@
 CurlFetchCmd(Tcl_Interp* interp, int objc, Tcl_Obj* CONST objv[])
 {
 	int theResult = TCL_OK;
+	bool handleAdded = false;
 	FILE* theFile = NULL;
 	char theErrorString[CURL_ERROR_SIZE];
 
@@ -486,6 +487,7 @@
 			theResult = SetResultFromCurlMErrorCode(interp, theCurlMCode);
 			break;
 		}
+		handleAdded = true;
 
 		/* select(2) the file descriptors used by curl and interleave with
 		 * checks for TclX signals */
@@ -555,10 +557,6 @@
 			fprintf(stderr, "Warning: curl_multi_info_read has %d more structs available\n", running);
 		}
 
-		/* Remove the handle from the multi handle, but ignore errors to avoid
-		 * cluttering the real error info that might be somewhere further up */
-		curl_multi_remove_handle(theMHandle, theHandle);
-
 		/* free header memory */
 		curl_slist_free_all(headers);
 
@@ -655,6 +653,13 @@
 		}
 	} while (0);
 
+	if (handleAdded) {
+		/* Remove the handle from the multi handle, but ignore errors to avoid
+		 * cluttering the real error info that might be somewhere further up */
+		curl_multi_remove_handle(theMHandle, theHandle);
+		handleAdded = false;
+	}
+
 	/* reset the connection */
 	if (theHandle != NULL) {
 		curl_easy_reset(theHandle);
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.macosforge.org/pipermail/macports-changes/attachments/20140408/f66846f4/attachment.html>