- Dmitriy Sergeyev pointed out that curl_easy_pause() didn't unpause properly

  during certain conditions. I also changed this code to use realloc() based
  on Daniel Fandrich's suggestion.

3 files changed, 14 insertions, 7 deletions

diff --git a/CHANGES b/CHANGES
index 9fbdc42af..7bcb6db7f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,11 @@
 
                                   Changelog
 
+Daniel Stenberg (5 Sep 2008)
+- Dmitriy Sergeyev pointed out that curl_easy_pause() didn't unpause properly
+  during certain conditions. I also changed this code to use realloc() based
+  on Daniel Fandrich's suggestion.
+
 Guenter Knauf (4 Sep 2008)
 - MingW32 non-configure builds are now largefile feature enabled by default.
   NetWare LIBC builds are also now largefile feature enabled by default.
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 3d846ceee..b8ea1972b 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -15,6 +15,7 @@ This release includes the following bugfixes:
 
  o MingW32 non-configure builds are now largefile feature enabled by default
  o NetWare LIBC builds are now largefile feature enabled by default
+ o curl_easy_pause() could behave wrongly on unpause
 
 This release includes the following known bugs:
 
@@ -27,6 +28,6 @@ Other curl-related news:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
- Keith Mok, Yang Tse, Daniel Fandrich, Guenter Knauf
+ Keith Mok, Yang Tse, Daniel Fandrich, Guenter Knauf, Dmitriy Sergeyev
 
         Thanks! (and sorry if I forgot to mention someone)
diff --git a/lib/easy.c b/lib/easy.c
index d83a88511..741dbb217 100644
--- a/lib/easy.c
+++ b/lib/easy.c
@@ -821,6 +821,7 @@ CURLcode curl_easy_pause(CURL *curl, int action)
        return PAUSE again and then we'll get a new copy allocted and stored in
        the tempwrite variables */
     char *tempwrite = data->state.tempwrite;
+    char *freewrite = tempwrite; /* store this pointer to free it later */
     size_t tempsize = data->state.tempwritesize;
     int temptype = data->state.tempwritetype;
     size_t chunklen;
@@ -845,7 +846,7 @@ CURLcode curl_easy_pause(CURL *curl, int action)
 
       result = Curl_client_write(data->state.current_conn,
                                  temptype, tempwrite, chunklen);
-      if(!result)
+      if(result)
         /* failures abort the loop at once */
         break;
 
@@ -858,13 +859,13 @@ CURLcode curl_easy_pause(CURL *curl, int action)
         */
         char *newptr;
 
-        free(data->state.tempwrite); /* free the one just cached as it isn't
-                                        enough */
-
         /* note that tempsize is still the size as before the callback was
            used, and thus the whole piece of data to keep */
-        newptr = malloc(tempsize);
+        newptr = realloc(data->state.tempwrite, tempsize);
+
         if(!newptr) {
+          free(data->state.tempwrite); /* free old area */
+          data->state.tempwrite = NULL;
           result = CURLE_OUT_OF_MEMORY;
           /* tempwrite will be freed further down */
           break;
@@ -882,7 +883,7 @@ CURLcode curl_easy_pause(CURL *curl, int action)
 
     } while((result == CURLE_OK) && tempsize);
 
-    free(tempwrite); /* this is unconditionally no longer used */
+    free(freewrite); /* this is unconditionally no longer used */
   }
 
   return result;