From: Christos Tsantilas <chtsanti@users.sourceforge.net>
Date: Fri, 5 Aug 2016 14:59:33 +0000 (+1200)
Subject: Squid segfault via Ftp::Client::readControlReply().
X-Git-Tag: SQUID_3_5_21~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad55923ea71332ede32331e3cf6153912d212407;p=thirdparty%2Fsquid.git

Squid segfault via Ftp::Client::readControlReply().

Ftp::Client::scheduleReadControlReply(), which may called from the
asynchronous start() or readControlReply()/handleControlReply()
handlers, does not check whether the control connection is still usable
before using it.

This is a Measurement Factory project.
---

diff --git a/src/clients/FtpClient.cc b/src/clients/FtpClient.cc
index bf4a5add07..ee95a90ed3 100644
--- a/src/clients/FtpClient.cc
+++ b/src/clients/FtpClient.cc
@@ -314,6 +314,11 @@ Ftp::Client::scheduleReadControlReply(int buffered_ok)
         /* We've already read some reply data */
         handleControlReply();
     } else {
+
+        if (!Comm::IsConnOpen(ctrl.conn)) {
+            debugs(9, 3, "cannot read without ctrl " << ctrl.conn);
+            return;
+        }
         /*
          * Cancel the timeout on the Data socket (if any) and
          * establish one on the control socket.