From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 6 Oct 2022 12:13:36 +0000 (+0200)
Subject: http_proxy: restore the protocol pointer on error
X-Git-Tag: curl-7_86_0~5
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=55e1875729f9d9fc7315cec611bffbd2c817ad89;p=thirdparty%2Fcurl.git

http_proxy: restore the protocol pointer on error

Reported-by: Trail of Bits

Closes #9790
---

diff --git a/lib/http_proxy.c b/lib/http_proxy.c
index 1f87f6c62a..cc20b3a801 100644
--- a/lib/http_proxy.c
+++ b/lib/http_proxy.c
@@ -212,10 +212,8 @@ void Curl_connect_done(struct Curl_easy *data)
     Curl_dyn_free(&s->rcvbuf);
     Curl_dyn_free(&s->req);
 
-    /* restore the protocol pointer, if not already done */
-    if(s->prot_save)
-      data->req.p.http = s->prot_save;
-    s->prot_save = NULL;
+    /* restore the protocol pointer */
+    data->req.p.http = s->prot_save;
     data->info.httpcode = 0; /* clear it as it might've been used for the
                                 proxy */
     data->req.ignorebody = FALSE;
diff --git a/lib/url.c b/lib/url.c
index 690c53c81a..be5ffca2d8 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -751,15 +751,6 @@ static void conn_shutdown(struct Curl_easy *data, struct connectdata *conn)
   DEBUGASSERT(data);
   infof(data, "Closing connection %ld", conn->connection_id);
 
-#ifndef USE_HYPER
-  if(conn->connect_state && conn->connect_state->prot_save) {
-    /* If this was closed with a CONNECT in progress, cleanup this temporary
-       struct arrangement */
-    data->req.p.http = NULL;
-    Curl_safefree(conn->connect_state->prot_save);
-  }
-#endif
-
   /* possible left-overs from the async name resolvers */
   Curl_resolver_cancel(data);