mirror of
https://github.com/openwrt/openwrt.git
synced 2025-02-08 20:10:37 +00:00
32 lines
1.0 KiB
Diff
32 lines
1.0 KiB
Diff
|
From 81d135d67155c5295b1033679c606165d4e28f3f Mon Sep 17 00:00:00 2001
|
||
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
||
|
|
Date: Thu, 18 Oct 2018 15:07:15 +0200
|
||
|
|
Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
|
||
|
|
use-after-free
|
||
|
|
|
||
|
|
Regression from b46cfbc068 (7.59.0)
|
||
|
|
CVE-2018-16840
|
||
|
|
Reported-by: Brian Carpenter (Geeknik Labs)
|
||
|
|
|
||
|
|
Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
|
||
|
|
---
|
||
|
|
lib/url.c | 4 +++-
|
||
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
--- a/lib/url.c
|
||
|
|
+++ b/lib/url.c
|
||
|
|
@@ -320,10 +320,12 @@ CURLcode Curl_close(struct Curl_easy *da
|
||
|
|
and detach this handle from there. */
|
||
|
|
curl_multi_remove_handle(data->multi, data);
|
||
|
|
|
||
|
|
- if(data->multi_easy)
|
||
|
|
+ if(data->multi_easy) {
|
||
|
|
/* when curl_easy_perform() is used, it creates its own multi handle to
|
||
|
|
use and this is the one */
|
||
|
|
curl_multi_cleanup(data->multi_easy);
|
||
|
|
+ data->multi_easy = NULL;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
/* Destroy the timeout list that is held in the easy handle. It is
|
||
|
|
/normally/ done by curl_multi_remove_handle() but this is "just in
|