Hi,

I have discovered a crash within curl 7.34.0 where we try to download a tftp file and the resolution timeout expires.

The crash occurs in tftp_done when trying to access state->error as state is NULL at this point.

A normal flow for tftp is the following:
tftp_connect -> tftp_do -> tftp_perform -> tftp_done

When the timeout expires in multi.c, the tftp_connect is not called and state is not initialised. The code then tries to go through tftp_done and the crash occours.

A simple fix for this would be to check for NULL in tftp_done.

I'm not sure if I need to open a bug against this or if I can be more help.

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2014-01-28