cURL / Mailing Lists / curl-library / Single Mail

curl-library

curl_easy_pause bugs

From: Dmitriy Sergeyev <dsergeyev_at_issart.com>
Date: Wed, 3 Sep 2008 17:46:22 +0700

Hello, Daniel.

Finally I've got a chance to use curl_easy_pause with some real
application, not just a tests. And it seems that I've found some bugs
in curl_easy_pause.
Lets look at easy.c at 848 string (CVS version)
====
      if(!result)
        /* failures abort the loop at once */
        break;
====
Basically the comment doesn't meet the code, because CURLE_OK is zero,
and loop breaks on OK result. However I suppose the comment meets the
logic, which intended to be implemented. Otherwise in case of large
data (according to other comments in code) we will miss some data.

Ironically this typo causes to not to run another bug when
write-callback succeed. Here is the suspicious sequence, starting from
878 line:
====
      else {
        tempsize -= chunklen; /* left after the call above */
        tempwrite += chunklen; /* advance the pointer */
      }

    } while((result == CURLE_OK) && tempsize);

    free(tempwrite); /* this is unconditionally no longer used */
====
tempwrite is increased by some value and later there is an attempt to
free() the memory at increased pointer. That is how actually my
application have crashed and I have noticed all these. My
write-callback returned error on continue after pause, the typo if()
condition became false and this wrong code have been executed with
crash on attempt to free invalid pointer.
Could you please pay attention to this code.

PS: Apologies that still haven't sent promised code with shared cookies problem.

--
Best regards,
Dmitriy Sergeyev, C++ Developer
of ISS Art, Ltd., Omsk, Russia
Web: http://www.issart.com
Received on 2008-09-03