setopt: more careful cleanup of the HSTS cache

Reported-by: Joshua Rogers
Closes #21615

diff --git a/lib/setopt.c b/lib/setopt.c
index 0fc5ec7e87faecb0de53b9dd090e316a40739c3a..2bc49868b81b0c379b54c6dad827fe34eb601a39 100644 (file)
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -1280,8 +1280,16 @@ static CURLcode setopt_long_misc(struct Curl_easy *data, CURLoption option,
           return CURLE_OUT_OF_MEMORY;
       }
     }
-    else
+    else if(!data->share || !data->share->hsts) {
+      /* throw away the HSTS cache unless shared */
       Curl_hsts_cleanup(&data->hsts);
+      /* flush all the entries */
+      curl_slist_free_all(data->state.hstslist);
+      data->state.hstslist = NULL;
+    }
+    else
+      /* detach from shared HSTS cache without freeing it */
+      data->hsts = NULL;
     break;
 #endif
 #ifndef CURL_DISABLE_ALTSVC