From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 6 Mar 2020 09:12:22 +0000 (+0100)
Subject: pause: bail out on bad input
X-Git-Tag: curl-7_69_1~31
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e54b1885d19dee5ed04761295020a0a84b8296ca;p=thirdparty%2Fcurl.git

pause: bail out on bad input

A NULL easy handle or an easy handle without an associated connection
cannot be paused or unpaused.

Closes #5050
---

diff --git a/lib/easy.c b/lib/easy.c
index 2446557f4d..33bc1aab79 100644
--- a/lib/easy.c
+++ b/lib/easy.c
@@ -973,15 +973,21 @@ void curl_easy_reset(struct Curl_easy *data)
  */
 CURLcode curl_easy_pause(struct Curl_easy *data, int action)
 {
-  struct SingleRequest *k = &data->req;
+  struct SingleRequest *k;
   CURLcode result = CURLE_OK;
-  int oldstate = k->keepon & (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE);
+  int oldstate;
+  int newstate;
 
-  /* first switch off both pause bits */
-  int newstate = k->keepon &~ (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE);
+  if(!GOOD_EASY_HANDLE(data) || !data->conn)
+    /* crazy input, don't continue */
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  k = &data->req;
+  oldstate = k->keepon & (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE);
 
-  /* set the new desired pause bits */
-  newstate |= ((action & CURLPAUSE_RECV)?KEEP_RECV_PAUSE:0) |
+  /* first switch off both pause bits then set the new pause bits */
+  newstate = (k->keepon &~ (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE)) |
+    ((action & CURLPAUSE_RECV)?KEEP_RECV_PAUSE:0) |
     ((action & CURLPAUSE_SEND)?KEEP_SEND_PAUSE:0);
 
   if((newstate & (KEEP_RECV_PAUSE| KEEP_SEND_PAUSE)) == oldstate) {