From: Emanuel Komínek <drake127@planescape.cz>
Date: Tue, 8 Oct 2024 16:35:13 +0000 (+0200)
Subject: multi: make curl_multi_cleanup invalidate magic latter
X-Git-Tag: curl-8_11_0~196
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=461ce6c6160b86439ddd74c59541231ec9e8558e;p=thirdparty%2Fcurl.git

multi: make curl_multi_cleanup invalidate magic latter

When a multi handle is being cleaned up, it can still cause user
callbacks to be fired. Notably Curl_cpool_destroy calls socket_callback
on all pooled connections. It's still possible for the callback to call
curl_multi_assign leading to an assert.

This commit moves clearing of a multi handle magic to a point where the
multi handle stops being a valid object.

Fixes #15201
Closes #15206
---

diff --git a/lib/multi.c b/lib/multi.c
index 65ba23de2a..7dce23138e 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -2727,8 +2727,6 @@ CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
     if(multi->in_callback)
       return CURLM_RECURSIVE_API_CALL;
 
-    multi->magic = 0; /* not good anymore */
-
     /* move the pending and msgsent entries back to process
        so that there is just one list to iterate over */
     unlink_all_msgsent_handles(multi);
@@ -2762,6 +2760,8 @@ CURLMcode curl_multi_cleanup(struct Curl_multi *multi)
 
     Curl_cpool_destroy(&multi->cpool);
 
+    multi->magic = 0; /* not good anymore */
+
     sockhash_destroy(&multi->sockhash);
     Curl_hash_destroy(&multi->proto_hash);
     Curl_hash_destroy(&multi->hostcache);