40 lines
1.2 KiB
Diff
40 lines
1.2 KiB
Diff
From 235f209a0e62edee654be441a50bb0c154edeaa5 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Thu, 18 Oct 2018 15:07:15 +0200
|
|
Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
|
|
use-after-free
|
|
|
|
Regression from b46cfbc068 (7.59.0)
|
|
CVE-2018-16840
|
|
Reported-by: Brian Carpenter (Geeknik Labs)
|
|
|
|
Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
|
|
|
|
Upstream-commit: 81d135d67155c5295b1033679c606165d4e28f3f
|
|
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
---
|
|
lib/url.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/lib/url.c b/lib/url.c
|
|
index f159008..dcc1ecc 100644
|
|
--- a/lib/url.c
|
|
+++ b/lib/url.c
|
|
@@ -319,10 +319,12 @@ CURLcode Curl_close(struct Curl_easy *data)
|
|
and detach this handle from there. */
|
|
curl_multi_remove_handle(data->multi, data);
|
|
|
|
- if(data->multi_easy)
|
|
+ if(data->multi_easy) {
|
|
/* when curl_easy_perform() is used, it creates its own multi handle to
|
|
use and this is the one */
|
|
curl_multi_cleanup(data->multi_easy);
|
|
+ data->multi_easy = NULL;
|
|
+ }
|
|
|
|
/* Destroy the timeout list that is held in the easy handle. It is
|
|
/normally/ done by curl_multi_remove_handle() but this is "just in
|
|
--
|
|
2.17.2
|
|
|