Bugs item #1896698, was opened at 2008-02-19 10:16
Message generated for change (Settings changed) made by zmey_
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=1896698&group_id=976
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: libcurl
Group: crash
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Zmey (zmey_)
Assigned to: Daniel Stenberg (bagder)
>Summary: NULL pointer dereferenced in Curl_done()
Initial Comment:
The problem appears both in libcurl 7.16.4 and 7.18.0 (latest to date).
Application crashes when traversing an FTP site (which is simply a series of FTP LIST commands). The crash is at the beginning of Curl_done() when it is called with connection pointer equal to NULL:
file url.c:
CURLcode Curl_done(struct connectdata **connp, /* 'connp' points to NULL */
CURLcode status,
bool premature)
{
CURLcode result;
struct connectdata *conn = *connp; /* assigning NULL to 'conn' */
struct SessionHandle *data = conn->data; /* dereferencing... Oops! */
...
Curl_done() is called from Curl_perform():
file transfer.c:
CURLcode Curl_perform(struct SessionHandle *data)
{
...
do {
res = connect_host(data, &conn); /* primary connection */
if(res == CURLE_OK) {
...
/* !!! note: this may nullify the connection! */
res = Curl_do(&conn, &do_done);
if(res == CURLE_OK) {
...
/* long and ugly-looking sequence of nested if()'s */
...
}
else /* !!! note: Curl_do() returned failure, 'conn' may be NULL */
/* Curl_do() failed, clean up left-overs in the done-call */
res2 = Curl_done(&conn, res, FALSE); /* oops... */
Proposed solution:
Check for NULL connection at the beginning of Curl_done():
file url.c:
CURLcode Curl_done(struct connectdata **connp,
CURLcode status,
bool premature)
{
CURLcode result;
struct connectdata *conn = *connp;
struct SessionHandle *data;
if(conn == NULL)
return CURLE_OK; /* or some error code */
data = conn->data; /* safe to dereference */
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=1896698&group_id=976
Received on 2008-02-19