From 235f209a0e62edee654be441a50bb0c154edeaa5 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Thu, 18 Oct 2018 15:07:15 +0200 Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid use-after-free Regression from b46cfbc068 (7.59.0) CVE-2018-16840 Reported-by: Brian Carpenter (Geeknik Labs) Bug: https://curl.haxx.se/docs/CVE-2018-16840.html Upstream-commit: 81d135d67155c5295b1033679c606165d4e28f3f Signed-off-by: Kamil Dudka --- lib/url.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/url.c b/lib/url.c index f159008..dcc1ecc 100644 --- a/lib/url.c +++ b/lib/url.c @@ -319,10 +319,12 @@ CURLcode Curl_close(struct Curl_easy *data) and detach this handle from there. */ curl_multi_remove_handle(data->multi, data); - if(data->multi_easy) + if(data->multi_easy) { /* when curl_easy_perform() is used, it creates its own multi handle to use and this is the one */ curl_multi_cleanup(data->multi_easy); + data->multi_easy = NULL; + } /* Destroy the timeout list that is held in the easy handle. It is /normally/ done by curl_multi_remove_handle() but this is "just in -- 2.17.2