post_per_transfer: remove the updated file name

When --remove-on-error is used with --no-clobber, it might have an
updated file name to remove.

Bug: https://curl.se/docs/CVE-2022-27778.html

CVE-2022-27778

Reported-by: Harry Sintonen
Closes #8824

diff --git a/src/tool_operate.c b/src/tool_operate.c
index cb587e0a64c41cd3baff872f5dd78009d1a14e5d..daaf0bcd49d7305a5299ed3bff54b21669cb0bbb 100644 (file)
--- a/src/tool_operate.c
+++ b/src/tool_operate.c
@@ -596,8 +596,8 @@ static CURLcode post_per_transfer(struct GlobalConfig *global,
         fprintf(global->errors, "curl: (%d) Failed writing body\n", result);
     }
     if(result && config->rm_partial) {
-      notef(global, "Removing output file: %s", per->outfile);
-      unlink(per->outfile);
+      notef(global, "Removing output file: %s\n", outs->filename);
+      unlink(outs->filename);
     }
   }