From 235f209a0e62edee654be441a50bb0c154edeaa5 Mon Sep 17 00:00:00 2001

From: Daniel Stenberg <daniel@haxx.se>

Date: Thu, 18 Oct 2018 15:07:15 +0200

Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid

 use-after-free

Regression from b46cfbc068 (7.59.0)

CVE-2018-16840

Reported-by: Brian Carpenter (Geeknik Labs)

Bug: https://curl.haxx.se/docs/CVE-2018-16840.html

Upstream-commit: 81d135d67155c5295b1033679c606165d4e28f3f

Signed-off-by: Kamil Dudka <kdudka@redhat.com>

---

 lib/url.c | 4 +++-

 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/url.c b/lib/url.c

index f159008..dcc1ecc 100644

--- a/lib/url.c

+++ b/lib/url.c

@@ -319,10 +319,12 @@ CURLcode Curl_close(struct Curl_easy *data)

        and detach this handle from there. */

     curl_multi_remove_handle(data->multi, data);

-  if(data->multi_easy)

+  if(data->multi_easy) {

     /* when curl_easy_perform() is used, it creates its own multi handle to

        use and this is the one */

     curl_multi_cleanup(data->multi_easy);

+    data->multi_easy = NULL;

+  }

   /* Destroy the timeout list that is held in the easy handle. It is

      /normally/ done by curl_multi_remove_handle() but this is "just in

-- 

2.17.2