--retry: access violation with URL part sets continued

When getting multiple URLs, curl didn't properly reset the byte counter
after a successful transfer so if the subsequent transfer failed it
would wrongly use the previous byte counter and behave badly (segfault)
because of that. The code assumes that the byte counter and the 'stream'
pointer is well in synch.

Reported by: Jon Sargeant
Bug: http://curl.haxx.se/bug/view.cgi?id=3028241

2 files changed, 4 insertions, 2 deletions

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index f65d2a83a..80835f91e 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -34,6 +34,7 @@ This release includes the following bugfixes:
  o threaded resolver: fix timeout issue
  o multi: fix condition that remove timers before trigger
  o examples: add curl_multi_timeout
+ o --retry: access violation with URL part sets continued
 
 This release includes the following known bugs:
 
diff --git a/src/main.c b/src/main.c
index 60e7b596b..35a352a8d 100644
--- a/src/main.c
+++ b/src/main.c
@@ -3464,6 +3464,7 @@ static size_t my_fwrite(void *buffer, size_t sz, size_t nmemb, void *stream)
   const size_t err_rc = (sz * nmemb) ? 0 : 1;
 
   if(!out->stream) {
+    out->bytes = 0; /* nothing written yet */
     if (!out->filename) {
       warnf(config, "Remote filename has no length!\n");
       return err_rc; /* Failure */
@@ -3491,10 +3492,9 @@ static size_t my_fwrite(void *buffer, size_t sz, size_t nmemb, void *stream)
 
   rc = fwrite(buffer, sz, nmemb, out->stream);
 
-  if((sz * nmemb) == rc) {
+  if((sz * nmemb) == rc)
     /* we added this amount of data to the output */
     out->bytes += (sz * nmemb);
-  }
 
   if(config->readbusy) {
     config->readbusy = FALSE;
@@ -4864,6 +4864,7 @@ operate(struct Configurable *config, int argc, argv_item_t argv[])
           }
           else {
             outs.stream = NULL; /* open when needed */
+            outs.bytes = 0;     /* reset byte counter */
           }
         }
         infdopen=FALSE;