luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

multi: remember connection_id before returning connection to pool

Browse Source 
Fix a bug that does not require a new CVE as discussed on hackerone.com.
Previously `connection_id` was accessed after returning connection to
the shared pool.

Bug: https://hackerone.com/reports/1463013
Closes #8355
This commit is contained in:
luminixinc on github 2022-01-27 11:52:26 -10:00 committed by Daniel Stenberg
parent 50e74ca18a
commit 3c798b1db3
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/multi.c
View File

@ -703,14 +703,15 @@ static CURLcode multi_done(struct Curl_easy *data,
conn->bits.conn_to_host ? conn->conn_to_host.dispname :
conn->host.dispname;
/* create string before returning the connection */
long connection_id = conn->connection_id;
msnprintf(buffer, sizeof(buffer),
"Connection #%ld to host %s left intact",
conn->connection_id, host);
connection_id, host);
/* the connection is no longer in use by this transfer */
CONNCACHE_UNLOCK(data);
if(Curl_conncache_return_conn(data, conn)) {
/* remember the most recently used connection */
data->state.lastconnect_id = conn->connection_id;
data->state.lastconnect_id = connection_id;
infof(data, "%s", buffer);
}
else