d73b74
From 235f209a0e62edee654be441a50bb0c154edeaa5 Mon Sep 17 00:00:00 2001
d73b74
From: Daniel Stenberg <daniel@haxx.se>
d73b74
Date: Thu, 18 Oct 2018 15:07:15 +0200
d73b74
Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
d73b74
 use-after-free
d73b74
d73b74
Regression from b46cfbc068 (7.59.0)
d73b74
CVE-2018-16840
d73b74
Reported-by: Brian Carpenter (Geeknik Labs)
d73b74
d73b74
Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
d73b74
d73b74
Upstream-commit: 81d135d67155c5295b1033679c606165d4e28f3f
d73b74
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
d73b74
---
d73b74
 lib/url.c | 4 +++-
d73b74
 1 file changed, 3 insertions(+), 1 deletion(-)
d73b74
d73b74
diff --git a/lib/url.c b/lib/url.c
d73b74
index f159008..dcc1ecc 100644
d73b74
--- a/lib/url.c
d73b74
+++ b/lib/url.c
d73b74
@@ -319,10 +319,12 @@ CURLcode Curl_close(struct Curl_easy *data)
d73b74
        and detach this handle from there. */
d73b74
     curl_multi_remove_handle(data->multi, data);
d73b74
 
d73b74
-  if(data->multi_easy)
d73b74
+  if(data->multi_easy) {
d73b74
     /* when curl_easy_perform() is used, it creates its own multi handle to
d73b74
        use and this is the one */
d73b74
     curl_multi_cleanup(data->multi_easy);
d73b74
+    data->multi_easy = NULL;
d73b74
+  }
d73b74
 
d73b74
   /* Destroy the timeout list that is held in the easy handle. It is
d73b74
      /normally/ done by curl_multi_remove_handle() but this is "just in
d73b74
-- 
d73b74
2.17.2
d73b74