Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libcurl v7.88.1 crash on cleanup with missing cookie file #10694

Closed
Keitagit-kun opened this issue Mar 6, 2023 · 13 comments
Closed

libcurl v7.88.1 crash on cleanup with missing cookie file #10694

Keitagit-kun opened this issue Mar 6, 2023 · 13 comments
Assignees
Labels
cookies crash not-a-bug This is not a bug in curl

Comments

@Keitagit-kun
Copy link

I get crush with libcurl v7.88.1 on call to curl_easy_cleanup() if cookies file is not exists originally.
If I manually create blank text-file (with relevant filename) - there a no crush and file content successfully written (in my test case only header as there is no cookies).
Without CURLOPT_COOKIEJAR option set - there a no crush...
With libcurl v7.86.0 crush did not happen, but also cookies file was not created/written.
If I remember right, with some previous version cookiesfile was created without problems...
Cookes engine setup (Windows):

curl_easy_setopt(cURLHandle, CURLOPT_COOKIESESSION, 1L)
curl_easy_setopt(cURLHandle, CURLOPT_COOKIEFILE, sCookiesFilePath)
curl_easy_setopt(cURLHandle, CURLOPT_COOKIEJAR, sCookiesFilePath)

on beginning of connection log there a message:
WARNING: failed to open cookie file "* full file path to cookie file *"

I expected the following

I expected cookes file is created/written by libcurl...

@bagder bagder added the cookies label Mar 6, 2023
@bagder
Copy link
Member

bagder commented Mar 6, 2023

Thanks a lot for your report!

I've failed to reproduce this problem myself, so can I ask you to provide us with more details on how to go ahead and repeat this. Preferably with a command line or a stand-alone program we can run from our ends against a public URL to trigger the problem?

@bagder bagder self-assigned this Mar 6, 2023
@bagder
Copy link
Member

bagder commented Mar 6, 2023

From my reading of the description, this command line should trigger the problem?

$ ls -l foo 
ls: cannot access 'foo': No such file or directory
$ curl curl.se -c foo -b foo -o /dev/null

@bagder bagder changed the title libcurl v7.88.1 crush on cleanup with missing cookie file libcurl v7.88.1 crash on cleanup with missing cookie file Mar 6, 2023
@bagder bagder added the crash label Mar 6, 2023
@SergeyRyabinin
Copy link

SergeyRyabinin commented Mar 7, 2023

Hello @bagder ,

We observe a similar issue (but a memory leak) with CURLOPT_COOKIEFILE in combination with curl_easy_reset.
In a recent change af5999a, there was an update to move cookies from data->state to data->set.

However, curl_easy_reset performs a non-conditional memset on data->set, however, the documentation was not updated

It does not change the following information kept in the handle: live connections, the Session ID cache, the DNS cache, the cookies, the shares or the alt-svc cache.

I believe that curl_easy_reset shall not cause a memory leak and must either

  • do not call memset;
  • or store-and-restore cookie data to-from a temp variable.

Best regards,
Sergey

@jay
Copy link
Member

jay commented Mar 8, 2023

I believe that curl_easy_reset shall not cause a memory leak and must either

does this solve it

(edit: patch moved to #10709)

jay added a commit to jay/curl that referenced this issue Mar 8, 2023
- Free set.cookelist in Curl_freeset instead of Curl_close.

Prior to this change the cookielist linked list wasn't freed by
curl_easy_reset which calls Curl_freeset to free all set.

Bug: curl#10694 (comment)
Reported-by: Sergey Ryabinin

Closes #xxxx
@bagder
Copy link
Member

bagder commented Mar 8, 2023

That was a memory-leak and thus a different matter and issue than what is reported here.

bagder added a commit that referenced this issue Mar 8, 2023
And make sure there is no memory leak

Ref: #10694
@Keitagit-kun
Copy link
Author

There some relation with verbose mode...
It in FreeBasic, but still reproduse crush:

Public Function MainDebug2() As Long Export
	' ........................................................................................
	'
	' ........................................................................................
	Dim cURLHandle As CURL Ptr, cURLSList As curl_slist Ptr = NULL, cURLRetValue As Long = 0
	Dim As ZString * 2048 sSourceURL, sCookiesFilePath
	' ........................................................................................
	'
	' ........................................................................................
	sSourceURL = "???"
	sCookiesFilePath = "C:\Temp\_CookiesFileInQuestion.txt"
	' ........................................................................................
	'
	' ........................................................................................
	cURLHandle = curl_easy_init()
	
	If cURLHandle = 0 Then
		Print	"x-> cURL Easy Init Fail"
		Return 1
	EndIf
	' ........................................................................................
	'
	' ........................................................................................
	Dim As tagcURLCallBackBuffer Ptr ptInfo = New tagcURLCallBackBuffer(65535)
	' ........................................................................................
	Dim As Long cURLErrorBufferSize		= CURL_ERROR_SIZE
	Dim As ZString Ptr cURLErrorBuffer	= Callocate(cURLErrorBufferSize + 1,1)
	' ........................................................................................
	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGFUNCTION, @cURLCallbackFunc_DebugTraceFuncEL)
	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGDATA, ptInfo)
	' ........................................................................................
	curl_easy_setopt(cURLHandle, CURLOPT_VERBOSE, 1L)
	' ........................................................................................
	curl_easy_setopt(cURLHandle, CURLOPT_URL, @sSourceURL)
	' ........................................................................................
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIESESSION, 1L)
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEFILE, sCookiesFilePath)
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEJAR, sCookiesFilePath)
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	cURLRetValue = curl_easy_perform(cURLHandle)
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	Print "--> Connection Log Start :"
	Print "--------------------------------------------------------------------------------------------"
	Print *ptInfo->strbuf
	Print "--------------------------------------------------------------------------------------------"
	Print "--> Connection Log End :"
	' ........................................................................................
	Delete ptInfo
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	Print "> CleanUp - 0"
	
	curl_slist_free_all(cURLSList)
	Sleep(1000,1)
	Print "> CleanUp - 1"
	
	curl_easy_cleanup(cURLHandle) ' <---------------------- crush
	Sleep(1000,1)
	Print "> CleanUp - 2"
	
	DeAllocate(cURLErrorBuffer)	:	cURLErrorBuffer = 0
	Sleep(1000,1)
	Print "> CleanUp - 3"
	
	' ........................................................................................
	Print "--> Done"
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	return 0
End Function

output is:

--------------------------------------------------------------------------------------------
WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt"
Closing connection -1

--------------------------------------------------------------------------------------------
--> Connection Log End :
> CleanUp - 0
> CleanUp - 1

if I do not set CURLOPT_DEBUGFUNCTION CURLOPT_DEBUGDATA then output is

--> Connection Log Start :
--------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------
--> Connection Log End :
> CleanUp - 0
> CleanUp - 1
> CleanUp - 2
> CleanUp - 3
--> Done
* WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt"
* Closing connection -1
* WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt"

and cookiefile is created

if I do not set CURLOPT_VERBOSE then output is

--> Connection Log Start :
--------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------
--> Connection Log End :
> CleanUp - 0
> CleanUp - 1
> CleanUp - 2
> CleanUp - 3
--> Done

and cookiefile is created

Calback function is:

Function cURLCallbackFunc_DebugTraceFuncEL Cdecl(ByVal handle As CURL Ptr, ByVal itype As curl_infotype, ByVal idata As ZString Ptr, ByVal iSize As size_t, ByVal zBuffer As tagcURLCallBackBuffer Ptr) as long
	
	Select Case As Const itype
		
		case CURLINFO_TEXT, CURLINFO_HEADER_OUT, CURLINFO_HEADER_IN
			
			If (zBuffer->size + iSize) >= zBuffer->allocated Then
				zBuffer->allocated += iSize
				zBuffer->allocated *= 2
				
				zBuffer->strbuf = ReAllocate(zBuffer->strbuf, zBuffer->allocated + 1)
										Clear(zBuffer->strbuf[zBuffer->size],0,zBuffer->allocated + 1 - zBuffer->size)
										memcpy(@zBuffer->strbuf[zBuffer->size],idata,iSize)
			Else
				Clear(zBuffer->strbuf[zBuffer->size],0,iSize + 1)
				memcpy(@zBuffer->strbuf[zBuffer->size],idata,iSize)
			EndIf
			
			zBuffer->size += iSize
			
	End Select
	
	Return 0
End Function

jay added a commit to jay/curl that referenced this issue Mar 9, 2023
- Free set.cookelist in Curl_freeset instead of Curl_close.

Prior to this change the cookielist linked list wasn't freed by
curl_easy_reset which calls Curl_freeset to free all set.

Bug: curl#10694 (comment)
Reported-by: Sergey Ryabinin

Closes #xxxx
jay pushed a commit to jay/curl that referenced this issue Mar 9, 2023
And make sure there is no memory leak

Ref: curl#10694
@Keitagit-kun
Copy link
Author

Keitagit-kun commented Mar 9, 2023

another addition - if I move deallocation of userdata Delete ptInfo to line after curl_easy_cleanup(cURLHandle) like that:

	Print "> CleanUp - 0"
	
	curl_slist_free_all(cURLSList)
	Sleep(1000,1)
	Print "> CleanUp - 1"
	
	curl_easy_cleanup(cURLHandle)
	Sleep(1000,1)
	Print "> CleanUp - 2"
	
	DeAllocate(cURLErrorBuffer)	:	cURLErrorBuffer = 0
	Sleep(1000,1)
	Print "> CleanUp - 3"
	
	Delete ptInfo
	Sleep(1000,1)
	Print "> CleanUp - 4"

Then there a no crush and cookiefile is created.

--> Connection Log End :
> CleanUp - 0
> CleanUp - 1
> CleanUp - 2
> CleanUp - 3
> CleanUp - 4
--> Done

I dont understand...
as side note - I applied memleak fix and there a no change...

@bagder
Copy link
Member

bagder commented Mar 9, 2023

I'm sorry, but I'm gonna need a recipe that uses libcurl directly or the command line tool. No binding.

@Keitagit-kun
Copy link
Author

well... i'm don't know C and dont have any means to work with it... but maybe this give some light to the problem:
first - I changed function like this:

Public Function MainDebug2() As Long Export
	' ........................................................................................
	'
	' ........................................................................................
	Dim cURLHandle As CURL Ptr, cURLSList As curl_slist Ptr = NULL, cURLRetValue As Long = 0
	Dim As ZString * 2048 sSourceURL, sCookiesFilePath
	' ........................................................................................
	'
	' ........................................................................................
	sSourceURL = "???"
	sCookiesFilePath = "C:\Temp\_CookiesFileInQuestion.txt"
	' ........................................................................................
	'
	' ........................................................................................
	Dim As tagcURLCallBackBuffer Ptr ptInfo = New tagcURLCallBackBuffer(1000000)
	' ........................................................................................	
	curl_global_init(CURL_GLOBAL_ALL)
	
	cURLHandle = curl_easy_init()
	' ........................................................................................
	'
	' ........................................................................................

	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGFUNCTION, @cURLCallbackFunc_DebugTraceFuncEL)
	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGDATA, ptInfo)
	' ........................................................................................
	curl_easy_setopt(cURLHandle, CURLOPT_VERBOSE, 1L)
	' ........................................................................................
	curl_easy_setopt(cURLHandle, CURLOPT_URL, @sSourceURL)
	' ........................................................................................
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIESESSION, 1L)
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEFILE, sCookiesFilePath)
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEJAR, sCookiesFilePath)
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	cURLRetValue = curl_easy_perform(cURLHandle)
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	Print "--> Connection Log Start (1) :"
	Print "--------------------------------------------------------------------------------------------"
	Print *ptInfo->strbuf
	Print "--------------------------------------------------------------------------------------------"
	Print "--> Connection Log End (1) :"
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	Print "> CleanUp - 0"
	
	curl_slist_free_all(cURLSList)
	Sleep(1000,1)
	Print "> CleanUp - 1"
	
	curl_easy_cleanup(cURLHandle)
	Sleep(1000,1)
	Print "> CleanUp - 2"
	
	Print "--> Connection Log Start (2) :"
	Print "--------------------------------------------------------------------------------------------"
	Print *ptInfo->strbuf
	Print "--------------------------------------------------------------------------------------------"
	Print "--> Connection Log End (2) :"
	
	Delete ptInfo
	Sleep(1000,1)
	Print "> CleanUp - 3"
	
	curl_global_cleanup()
	Sleep(1000,1)
	Print "> CleanUp - 4"
	' ........................................................................................
	Print "--> Done"
	' ----------------------------------------------------------------------------------------
	'
	' ----------------------------------------------------------------------------------------
	return 0
End Function

and callback to this:

Function cURLCallbackFunc_DebugTraceFuncEL Cdecl(ByVal handle As CURL Ptr, ByVal itype As curl_infotype, ByVal idata As ZString Ptr, ByVal iSize As size_t, ByVal zBuffer As tagcURLCallBackBuffer Ptr) as Long
	
	Select Case As Const itype
		
		case CURLINFO_TEXT, CURLINFO_HEADER_OUT, CURLINFO_HEADER_IN
			
			Dim As ZString Ptr buff = CPtr(tagcURLCallBackBuffer Ptr, zBuffer)->strbuf
			
			Print ">> 1-0 ";zBuffer,zBuffer->strbuf
			Print ">> 1-1 ";zBuffer->size,iSize
			Print ">> 1-2 ";zBuffer->allocated
			
			Clear(zBuffer->strbuf[zBuffer->size],0,iSize + 1)
			memcpy(@zBuffer->strbuf[zBuffer->size],idata,iSize)
			
			zBuffer->size += iSize
			
			Print ">> 2-0 ";zBuffer,zBuffer->strbuf
			Print ">> 2-1 ";zBuffer->size,iSize
			Print ">> 2-2 ";zBuffer->allocated
			
	End Select
	
	Return 0
End Function

and get this output:

>> 1-0 10797104              54132864
>> 1-1 0      73
>> 1-2 1000000
>> 2-0 10797104             54132864
>> 2-1 73     73
>> 2-2 1000000
>> 1-0 10797104             54132864
>> 1-1 73     22
>> 1-2 1000000
>> 2-0 10797104             54132864
>> 2-1 95     22
>> 2-2 1000000
--> Connection Log Start (1) :
--------------------------------------------------------------------------------------------
WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt"
Closing connection -1

--------------------------------------------------------------------------------------------
--> Connection Log End (1) :
> CleanUp - 0
> CleanUp - 1
>> 1-0 10797104             54132864
>> 1-1 95     73
>> 1-2 1000000
>> 2-0 10797104             54132864
>> 2-1 168    73
>> 2-2 1000000
> CleanUp - 2
--> Connection Log Start (2) :
--------------------------------------------------------------------------------------------
WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt"
Closing connection -1
WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt"

--------------------------------------------------------------------------------------------
--> Connection Log End (2) :
> CleanUp - 3
> CleanUp - 4
--> Done

now if Imove deallocation of user pointer to before curl_easy_cleanup() function like that:

Delete ptInfo

	Print "> CleanUp - 0"
	
	curl_slist_free_all(cURLSList)
	Sleep(1000,1)
	Print "> CleanUp - 1"
	
	curl_easy_cleanup(cURLHandle)
	Sleep(1000,1)
	Print "> CleanUp - 2"
	
	Print "--> Connection Log Start (2) :"
	Print "--------------------------------------------------------------------------------------------"
	Print *ptInfo->strbuf
	Print "--------------------------------------------------------------------------------------------"
	Print "--> Connection Log End (2) :"
	
	
	Sleep(1000,1)
	Print "> CleanUp - 3"
	
	curl_global_cleanup()
	Sleep(1000,1)
	Print "> CleanUp - 4"
	' ........................................................................................
	Print "--> Done"

then I get:

>> 1-0 10797104              54132864
>> 1-1 0      73
>> 1-2 1000000
>> 2-0 10797104             54132864
>> 2-1 73     73
>> 2-2 1000000
>> 1-0 10797104             54132864
>> 1-1 73     22
>> 1-2 1000000
>> 2-0 10797104             54132864
>> 2-1 95     22
>> 2-2 1000000
--> Connection Log Start (1) :
--------------------------------------------------------------------------------------------
WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt"
Closing connection -1

--------------------------------------------------------------------------------------------
--> Connection Log End (1) :
> CleanUp - 0
> CleanUp - 1
>> 1-0 10797104             65535
>> 1-1 0      73
>> 1-2 0

You can see that debug func was called in curl_easy_cleanup(), outside curl_easy_perform()
and to that moment pointer of string buffer changed (as it was deallocated)
So answer to problem is simple:
up to curl 7.86 curl_easy_cleanup() did not called debug func, and now it do so - see
second WARNING: failed to open cookie file "C:\Temp\_CookiesFileInQuestion.txt" line
in first log.
To summ it up: to counter crush user pointer should be deallocated strictly after call to curl_easy_cleanup()
I think it should be menthioned in docs.

jay added a commit that referenced this issue Mar 10, 2023
- Free set.cookelist in Curl_freeset instead of Curl_close.

Prior to this change the cookielist linked list wasn't freed by
curl_easy_reset which calls Curl_freeset to free all set.

Bug: #10694 (comment)
Reported-by: Sergey Ryabinin

Closes #10709
jay pushed a commit that referenced this issue Mar 10, 2023
This also tests for the memory leak bug fixed by parent commit b559ef6.

Ref: #10694

Closes #10712
@Keitagit-kun
Copy link
Author

Hope this reproduser (win) is not completely wrong...

#include <curl/curl.h>
#include "crt/string.bi"
#include "crt/io.bi"

struct tagcURLCallBackBuffer {
  char *strbuf;
  unsigned int size;
  unsigned int allocated;
};

static int cURLCallbackFunc_DebugTraceFuncEL Cdecl(CURL *handle, curl_infotype itype, char *idata, size_t iSize, tagcURLCallBackBuffer *zBuffer)
{
	(void)handle; /* prevent compiler warning */
	
	if (itype == CURLINFO_TEXT || itype = CURLINFO_HEADER_OUT || itype = CURLINFO_HEADER_IN) {
			memset(&zBuffer->strbuf[zBuffer->size],0,iSize + 1);
			memcpy(&zBuffer->strbuf[zBuffer->size],idata,iSize);
			zBuffer->size += iSize;
			}
	
	Return 0;
}


static void MainDebug3()
{
	CURL *cURLHandle;
	CURLcode cURLRetValue;
	tagcURLCallBackBuffer ptInfo;
	
	ptInfo->allocated = 1000000;
	ptInfo->size = 0;
	ptInfo->strbuf = calloc(1, ptInfo->allocated);
	
	remove(&"C:\Temp\_CookiesFileInQuestion.txt");
	
	Sleep(1000);
	
	curl_global_init(CURL_GLOBAL_ALL);
	
	cURLHandle = curl_easy_init();
	
	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGFUNCTION, @cURLCallbackFunc_DebugTraceFuncEL);
	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGDATA, &ptInfo);
	curl_easy_setopt(cURLHandle, CURLOPT_VERBOSE, 1L);
	curl_easy_setopt(cURLHandle, CURLOPT_URL, "???");
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIESESSION, 1L);
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEFILE, "C:\Temp\_CookiesFileInQuestion.txt");
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEJAR, "C:\Temp\_CookiesFileInQuestion.txt");
	
	cURLRetValue = curl_easy_perform(cURLHandle);
	
	free(ptInfo->strbuf);
	ptInfo->allocated = 0;
	ptInfo->size = 0;
	ptInfo->strbuf = null;
	
	curl_easy_cleanup(cURLHandle);
	
	curl_global_cleanup();
}

MainDebug3()

@jay
Copy link
Member

jay commented Mar 12, 2023

Thanks.

I cleaned up your most recent C example and was able to use it to reproduce with curl-7_88_1. (Click to expand)
#include <crtdbg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <curl/curl.h>
#include <openssl/crypto.h>

struct tagcURLCallBackBuffer {
  char *strbuf;
  unsigned int size;
  unsigned int allocated;
};

static int cURLCallbackFunc_DebugTraceFuncEL (CURL *handle, curl_infotype itype, char *idata, size_t iSize, tagcURLCallBackBuffer *zBuffer)
{
	(void)handle; /* prevent compiler warning */
	
	if (itype == CURLINFO_TEXT || itype == CURLINFO_HEADER_OUT || itype == CURLINFO_HEADER_IN) {
			memset(&zBuffer->strbuf[zBuffer->size],0,iSize + 1);
			memcpy(&zBuffer->strbuf[zBuffer->size],idata,iSize);
			zBuffer->size += iSize;
	}
	
	return 0;
}

int main(void)
{
	CURL *cURLHandle;
	CURLcode cURLRetValue;
	tagcURLCallBackBuffer info;
  tagcURLCallBackBuffer *ptInfo = &info;
  const char *cookiefile = "C:\\Temp\\_CookiesFileInQuestion.txt";
	
  _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_FILE);
  _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
  _CrtSetDbgFlag(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_LEAK_CHECK_DF | _CRTDBG_DELAY_FREE_MEM_DF);

  ptInfo->allocated = 1000000;
	ptInfo->size = 0;
	ptInfo->strbuf = (char *)calloc(1, ptInfo->allocated);
	
	unlink(cookiefile);
	
	Sleep(1000);
	
	curl_global_init(CURL_GLOBAL_ALL);
	
	cURLHandle = curl_easy_init();
	
	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGFUNCTION, cURLCallbackFunc_DebugTraceFuncEL);
	curl_easy_setopt(cURLHandle, CURLOPT_DEBUGDATA, ptInfo);
	curl_easy_setopt(cURLHandle, CURLOPT_VERBOSE, 1L);
	curl_easy_setopt(cURLHandle, CURLOPT_URL, "http://curl.se");
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIESESSION, 1L);
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEFILE, cookiefile);
	curl_easy_setopt(cURLHandle, CURLOPT_COOKIEJAR, cookiefile);
	
	cURLRetValue = curl_easy_perform(cURLHandle);
	
	free(ptInfo->strbuf);
	ptInfo->allocated = 0;
	ptInfo->size = 0;
	ptInfo->strbuf = NULL;
	
	curl_easy_cleanup(cURLHandle);
	
	curl_global_cleanup();

  OPENSSL_cleanup();
  _CrtMemDumpAllObjectsSince(NULL);
  printf("\n");

  return 0;
}

The crash is because the memory used by your debug callback is freed before calling curl_easy_cleanup. As long as DEBUGFUNCTION is set then any curl_xxx function that operates on the handle may call it. As you've already figured out, when you free the memory after curl_easy_cleanup then there is no crash. However, your original example in VB code seems to show that you already do that...

Can you confirm that there is no crash in your actual code if you free the memory after curl_easy_cleanup?

Note the C example will crash with curl-7_88_1 but not with master (674a066 2023-03-10) because 45d4bf5 changed the behavior not to re-read the cookie files on cleanup so there is no verbose text (like file not found etc) when that happens. Even though it doesn't crash that's just by chance. It still may crash if you free the memory before curl_easy_cleanup.

@Keitagit-kun
Copy link
Author

Yes, there is no crash if i free memory after curl_easy_cleanup().
Thanks

@jay jay added not-a-bug This is not a bug in curl and removed needs-info labels Mar 13, 2023
@jay
Copy link
Member

jay commented Mar 13, 2023

No problem, thanks for the update.

@jay jay closed this as not planned Won't fix, can't repro, duplicate, stale Mar 13, 2023
bch pushed a commit to bch/curl that referenced this issue Jul 19, 2023
- Free set.cookelist in Curl_freeset instead of Curl_close.

Prior to this change the cookielist linked list wasn't freed by
curl_easy_reset which calls Curl_freeset to free all set.

Bug: curl#10694 (comment)
Reported-by: Sergey Ryabinin

Closes curl#10709
bch pushed a commit to bch/curl that referenced this issue Jul 19, 2023
This also tests for the memory leak bug fixed by parent commit b559ef6.

Ref: curl#10694

Closes curl#10712
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cookies crash not-a-bug This is not a bug in curl
Development

No branches or pull requests

4 participants