]> git.ipfire.org Git - thirdparty/curl.git/commitdiff
select: avoid a NULL deref in cwfds_add_sock
authorDaniel Stenberg <daniel@haxx.se>
Wed, 1 Jan 2025 00:00:33 +0000 (01:00 +0100)
committerDaniel Stenberg <daniel@haxx.se>
Wed, 1 Jan 2025 19:56:27 +0000 (20:56 +0100)
curl_multi_waitfds(m, NULL, ...);

=> Curl_waitfds_init(&cwfds, ufds, size);

=> Curl_waitfds_add_ps(&cwfds);

=>   cwfds_add_sock(cwfds, ...);

Would then try to use the ->wfds array while set to NULL previously.
This should not happen, which this is now also protected with an assert
to trigger debug builds if it happens.

Caught by CodeSonar

Assisted-by: Jay Satiro
Closes #15881

lib/select.c

index a0f2ade071b19b980450cf6a75545455e3506301..a14696d114b71365c1dfff6def196338e514cd3d 100644 (file)
@@ -503,7 +503,10 @@ static unsigned int cwfds_add_sock(struct curl_waitfds *cwfds,
                                    curl_socket_t sock, short events)
 {
   int i;
-
+  if(!cwfds->wfds) {
+    DEBUGASSERT(!cwfds->count && !cwfds->n);
+    return 1;
+  }
   if(cwfds->n <= INT_MAX) {
     for(i = (int)cwfds->n - 1; i >= 0; --i) {
       if(sock == cwfds->wfds[i].fd) {