From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 15 Aug 2024 09:06:38 +0000 (+0200)
Subject: multi: on socket callback error, remove socket hash entry nonetheless
X-Git-Tag: curl-8_10_0~245
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=160f0233590d0a02422594104ae805e1aa08d3db;p=thirdparty%2Fcurl.git

multi: on socket callback error, remove socket hash entry nonetheless

Previously an error from the callback accidentally made libcurl keep the
hash entry which would lead to the entry remaining and then potentially
getting removed *again* which would lead to internal confusions.

This is an old issue (introduced in 2b3dd01b779e4eff6), caught by the new
asserts from c0233a35da81.

Closes #14557
---

diff --git a/lib/multi.c b/lib/multi.c
index 2e62e56b62..b07ebe5d07 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -3013,17 +3013,20 @@ CURLMcode Curl_multi_pollset_ev(struct Curl_multi *multi,
       if(oldactions & CURL_POLL_IN)
         entry->readers--;
       if(!entry->users) {
+        bool dead = FALSE;
         if(multi->socket_cb) {
           set_in_callback(multi, TRUE);
           rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
                                 multi->socket_userp, entry->socketp);
           set_in_callback(multi, FALSE);
-          if(rc == -1) {
-            multi->dead = TRUE;
-            return CURLM_ABORTED_BY_CALLBACK;
-          }
+          if(rc == -1)
+            dead = TRUE;
         }
         sh_delentry(entry, &multi->sockhash, s);
+        if(dead) {
+          multi->dead = TRUE;
+          return CURLM_ABORTED_BY_CALLBACK;
+        }
       }
       else {
         /* still users, but remove this handle as a user of this socket */