[patch] curl-7.17.1-null-handler-segfault.patch

curl-7.17.1-null-handler-segfault.patch (text/plain), 2.74 KB, created by Robin Johnson on 2007-11-12 13:44:16 UTC

Segfault in CURL (used from PHP)
Found by Robin H. Johnson <[e-mail]>
This was because of an invalid URL: /hash/597cfbe5740d2bf91eb4b037e6750bacd76d3729/added

#0  0x00002b33e61ba166 in Curl_disconnect (conn=0xe46210) at url.c:2077
2077	  if(conn->handler->disconnect)
(gdb) print conn->handler
$1 = (const struct Curl_handler *) 0x0
(gdb) bt full
#0  0x00002b33e61ba166 in Curl_disconnect (conn=0xe46210) at url.c:2077
	data = (struct SessionHandle *) 0xe363d0
#1  0x00002b33e61bc27e in Curl_connect (data=0xe363d0, in_connect=0x7fffc6067818, asyncp=0x7fffc6067827, protocol_done=0x7fffc6067826) at url.c:4255
	connected = false
	code = CURLE_OK
	dns = (struct Curl_dns_entry *) 0x0
#2  0x00002b33e61c67db in Curl_perform (data=0xe363d0) at transfer.c:2333
	res = CURLE_OK
	res2 = <value optimized out>
	conn = (struct connectdata *) 0xe46210
	newurl = 0x0
	retry = 232
#3  0x0000000000472005 in zif_curl_exec ()
#4  0x000000000061bd42 in ?? ()
#5  0x000000000061ae23 in execute ()
#6  0x000000000061b815 in ?? ()
#7  0x000000000061ae23 in execute ()
#8  0x00000000005fcef3 in zend_execute_scripts ()
#9  0x00000000005bd468 in php_execute_script ()
#10 0x00000000006791ab in main ()

diff -Nuar curl-7.17.1-20071013.orig/lib/url.c curl-7.17.1-20071013/lib/url.c
--- curl-7.17.1-20071013.orig/lib/url.c	2007-10-13 02:00:02.000000000 +0000
+++ curl-7.17.1-20071013/lib/url.c	2007-11-12 13:13:37.401514781 +0000
@@ -2074,7 +2074,7 @@
     Curl_ntlm_cleanup(conn);
   }
 
-  if(conn->handler->disconnect)
+  if(conn->handler && conn->handler->disconnect)
     /* This is set if protocol-specific cleanups should be made */
     conn->handler->disconnect(conn);
 
@@ -2594,7 +2594,7 @@
                           curl_socket_t *socks,
                           int numsocks)
 {
-  if(conn->handler->proto_getsock)
+  if(conn && conn->handler && conn->handler->proto_getsock)
     return conn->handler->proto_getsock(conn, socks, numsocks);
   return GETSOCK_BLANK;
 }
@@ -4325,7 +4325,7 @@
   }
 
   /* this calls the protocol-specific function pointer previously set */
-  if(conn->handler->done)
+  if(conn->handler && conn->handler->done)
     result = conn->handler->done(conn, status, premature);
   else
     result = CURLE_OK;
@@ -4378,7 +4378,7 @@
   conn->bits.done = FALSE; /* Curl_done() is not called yet */
   conn->bits.do_more = FALSE; /* by default there's no curl_do_more() to use */
 
-  if(conn->handler->do_it) {
+  if(conn->handler && conn->handler->do_it) {
     /* generic protocol-specific function pointer set in curl_connect() */
     result = conn->handler->do_it(conn, done);
 
@@ -4441,7 +4441,7 @@
 {
   CURLcode result=CURLE_OK;
 
-  if(conn->handler->do_more)
+  if(conn->handler && conn->handler->do_more)
     result = conn->handler->do_more(conn);
 
   return result;