From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 18 Oct 2018 13:07:15 +0000 (+0200)
Subject: Curl_close: clear data->multi_easy on free to avoid use-after-free
X-Git-Tag: curl-7_62_0~13
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=81d135d67155c5295b1033679c606165d4e28f3f;p=thirdparty%2Fcurl.git

Curl_close: clear data->multi_easy on free to avoid use-after-free

Regression from b46cfbc068 (7.59.0)
CVE-2018-16840
Reported-by: Brian Carpenter (Geeknik Labs)

Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
---

diff --git a/lib/url.c b/lib/url.c
index 723b898065..0d5a13f996 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -331,10 +331,12 @@ CURLcode Curl_close(struct Curl_easy *data)
        and detach this handle from there. */
     curl_multi_remove_handle(data->multi, data);
 
-  if(data->multi_easy)
+  if(data->multi_easy) {
     /* when curl_easy_perform() is used, it creates its own multi handle to
        use and this is the one */
     curl_multi_cleanup(data->multi_easy);
+    data->multi_easy = NULL;
+  }
 
   /* Destroy the timeout list that is held in the easy handle. It is
      /normally/ done by curl_multi_remove_handle() but this is "just in