From: Dan Fandrich <dan@coneharvesters.com>
Date: Wed, 30 Jul 2014 21:18:47 +0000 (+0200)
Subject: smtp: fixed a segfault during test 1320 torture test
X-Git-Tag: curl-7_38_0~162
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2c1db913f73ff29291969ca7bf6f3bf8e1f34069;p=thirdparty%2Fcurl.git

smtp: fixed a segfault during test 1320 torture test

Under these circumstances, the connection hasn't been fully established
and smtp_connect hasn't been called, yet smtp_done still calls the state
machine which dereferences the NULL conn pointer in struct pingpong.
---

diff --git a/lib/smtp.c b/lib/smtp.c
index 5938c3ff43..da76017240 100644
--- a/lib/smtp.c
+++ b/lib/smtp.c
@@ -1642,7 +1642,7 @@ static CURLcode smtp_done(struct connectdata *conn, CURLcode status,
 
   (void)premature;
 
-  if(!smtp)
+  if(!smtp || !pp->conn)
     /* When the easy handle is removed from the multi interface while libcurl
        is still trying to resolve the host name, the SMTP struct is not yet
        initialized. However, the removal action calls Curl_done() which in