On Wed, 3 Sep 2008, Dan Fandrich wrote:

> Something like this patch is also needed to ensure that data->state.tempwrite

[...]

> But this whole block should probably be rewritten to use realloc().

Right, so I figure this approach is more like it:

Index: lib/easy.c
===================================================================
RCS file: /cvsroot/curl/curl/lib/easy.c,v
retrieving revision 1.123
diff -u -r1.123 easy.c
--- lib/easy.c 31 Aug 2008 12:12:35 -0000 1.123
+++ lib/easy.c 4 Sep 2008 07:49:37 -0000
@@ -821,6 +821,7 @@
         return PAUSE again and then we'll get a new copy allocted and stored in
         the tempwrite variables */
      char *tempwrite = data->state.tempwrite;
+ char *freewrite = tempwrite; /* store this pointer to free it later */
      size_t tempsize = data->state.tempwritesize;
      int temptype = data->state.tempwritetype;
      size_t chunklen;
@@ -845,7 +846,7 @@

        result = Curl_client_write(data->state.current_conn,
                                   temptype, tempwrite, chunklen);
- if(!result)
+ if(result)
          /* failures abort the loop at once */
          break;

@@ -858,13 +859,13 @@
          */
          char *newptr;

- free(data->state.tempwrite); /* free the one just cached as it isn't
- enough */
-
          /* note that tempsize is still the size as before the callback was
             used, and thus the whole piece of data to keep */
- newptr = malloc(tempsize);
+ newptr = realloc(data->state.tempwrite, tempsize);
+
          if(!newptr) {
+ free(data->state.tempwrite); /* free old area */
+ data->state.tempwrite = NULL;
            result = CURLE_OUT_OF_MEMORY;
            /* tempwrite will be freed further down */
            break;
@@ -882,7 +883,7 @@

      } while((result == CURLE_OK) && tempsize);

- free(tempwrite); /* this is unconditionally no longer used */
+ free(freewrite); /* this is unconditionally no longer used */
    }

    return result;

-- 
  / daniel.haxx.se