cURL / Mailing Lists / curl-library / Single Mail

curl-library

Re: [patch] libcurl 7.12.2-20040917 and CURLOPT_VERBOSE may read free()ed data

From: Bertrand Demiddelaer <bdemiddelaer_at_denyall.com>
Date: Thu, 23 Sep 2004 15:38:29 +0200

Daniel Stenberg wrote:
> On Wed, 22 Sep 2004, Bertrand Demiddelaer wrote:
>
>> The problem is that the dns_entry in my application is shared with
>> another connection. When the dns_entry is older than 60 seconds and
>> the dns->inuse is zero it can be free()ed. But as conn->ip_addr shares
>> data with conn->dsn_entry, when the dns_entry is free()ed by another
>> completed connection, it makes conn->ip_addr invalid...
>
>
> But how can ip_addr point to a struct that has the inuse counter set to
> 0? It is supposed to point into a struct that is resolved and that is
> unlocked (inuse counter decreased) after the whole request is completed.

Curl_resolv_unlock() is not always called from Curl_done()... btw, I
read somewhere it should be called only once per Curl_resolv_lock()
call, maybe we should have a look at this ?

> I'm not saying you're wrong or that your fix is bad. I'm trying to
> understand how the situation occurs when your fix is needed, as I think
> the need seems to imply another (more inolved) bug somewhere.

No pb :-) I would say you're probably right, but I was too lazy to make
a low level fix...

> Would you be able to write a sample program that repeats this problem?
> It would be very helpful. I could turn it into a test case once we've
> fixed the problem completely.

Here it is !

  • text/x-csrc attachment: foo.c
Received on 2004-09-23