multi: make curl_multi_cleanup invalidate magic latter

When a multi handle is being cleaned up, it can still cause user
callbacks to be fired. Notably Curl_cpool_destroy calls socket_callback
on all pooled connections. It's still possible for the callback to call
curl_multi_assign leading to an assert.

This commit moves clearing of a multi handle magic to a point where the
multi handle stops being a valid object.

Fixes #15201
Closes #15206

diff --git a/lib/multi.c b/lib/multi.c
index 65ba23de2a15f5bf2c4b23604009c4c07e641879..7dce23138e4955a402d1d5e5b3490985f27fb7fc 100644 (file)
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -2727,8 +2727,6 @@ CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
     if(multi->in_callback)
       return CURLM_RECURSIVE_API_CALL;
 
-    multi->magic = 0; /* not good anymore */
-
     /* move the pending and msgsent entries back to process
        so that there is just one list to iterate over */
     unlink_all_msgsent_handles(multi);
@@ -2762,6 +2760,8 @@ CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
 
     Curl_cpool_destroy(&multi->cpool);
 
+    multi->magic = 0; /* not good anymore */
+
     sockhash_destroy(&multi->sockhash);
     Curl_hash_destroy(&multi->proto_hash);
     Curl_hash_destroy(&multi->hostcache);