From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 23 Jan 2008 12:22:04 +0000 (+0000)
Subject: Dmitry Kurochkin's pipelining close-down segfault fix
X-Git-Tag: curl-7_18_0~22
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=79cb74f03a4fa5512812cc8c8e35d735a099b35c;p=thirdparty%2Fcurl.git

Dmitry Kurochkin's pipelining close-down segfault fix
---

diff --git a/lib/multi.c b/lib/multi.c
index e531dd60ba..f52cce5df2 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -584,13 +584,18 @@ CURLMcode curl_multi_remove_handle(CURLM *multi_handle,
          alive connections when this is removed */
       multi->num_alive--;
 
-    if(easy->easy_handle->state.is_in_pipeline &&
+    if(easy->easy_conn &&
+        easy->easy_handle->state.is_in_pipeline &&
         easy->state > CURLM_STATE_WAITDO &&
-        easy->state < CURLM_STATE_COMPLETED)
+        easy->state < CURLM_STATE_COMPLETED) {
       /* If the handle is in a pipeline and has started sending off its
          request but not received its reponse yet, we need to close
          connection. */
       easy->easy_conn->bits.close = TRUE;
+      /* Set connection owner so that Curl_done() closes it.
+         We can sefely do this here since connection is killed. */
+      easy->easy_conn->data = easy->easy_handle;
+    }
 
     /* The timer must be shut down before easy->multi is set to NULL,
        else the timenode will remain in the splay tree after