cURL / Mailing Lists / curl-library / Single Mail

curl-library

Re: invalid free after an http redirect to ftp

From: Daniel Stenberg <daniel_at_haxx.se>
Date: Fri, 12 Oct 2007 17:20:51 +0200 (CEST)

On Fri, 12 Oct 2007, Michal Marek wrote:

> since 7.16.0, Curl_ftp_connect() calls Curl_ftp_disconnect() if there's a
> data->reqdata.proto.ftp pointer from a previous connection. The problem is,
> that it doesn't check whether it's actually a valid struct FTP pointer
> (proto is a union). So if curl gets a HTTP 302 redirect to

[...]

> $ ./src/curl -Lv http://ftp.uninett.no/pub/find.gz

Right, I've been fearing that the "data->reqdata" approach would come back to
haunt us and I guess this sort of did. This is clearly a bad piece of code...

With the newly introduced handler concept, I figure it will be easier to call
the correct disconnect function for the existing context rather than to assume
that it is an FTP one.

You up to providing a patch? I'm not sure I'll get time to do anything about
this until after my trip to China (alas after october 21).

-- 
  Commercial curl and libcurl Technical Support: http://haxx.se/curl.html
Received on 2007-10-12