curl-library
Re: [patch] libcurl 7.12.2-20040917 and CURLOPT_VERBOSE may read free()ed data
Date: Thu, 23 Sep 2004 15:38:29 +0200
Daniel Stenberg wrote:
> On Wed, 22 Sep 2004, Bertrand Demiddelaer wrote:
>
>> The problem is that the dns_entry in my application is shared with
>> another connection. When the dns_entry is older than 60 seconds and
>> the dns->inuse is zero it can be free()ed. But as conn->ip_addr shares
>> data with conn->dsn_entry, when the dns_entry is free()ed by another
>> completed connection, it makes conn->ip_addr invalid...
>
>
> But how can ip_addr point to a struct that has the inuse counter set to
> 0? It is supposed to point into a struct that is resolved and that is
> unlocked (inuse counter decreased) after the whole request is completed.
Curl_resolv_unlock() is not always called from Curl_done()... btw, I
read somewhere it should be called only once per Curl_resolv_lock()
call, maybe we should have a look at this ?
> I'm not saying you're wrong or that your fix is bad. I'm trying to
> understand how the situation occurs when your fix is needed, as I think
> the need seems to imply another (more inolved) bug somewhere.
No pb :-) I would say you're probably right, but I was too lazy to make
a low level fix...
> Would you be able to write a sample program that repeats this problem?
> It would be very helpful. I could turn it into a test case once we've
> fixed the problem completely.
Here it is !
- text/x-csrc attachment: foo.c