Sonia Subramanian brought our attention to a problem that happens if you set

the CURLOPT_RESUME_FROM or CURLOPT_RANGE options and an existing connection
in the connection cache is closed to make room for the new one when you call
curl_easy_perform(). It would then wrongly free range-related data in the
connection close funtion.

3 files changed, 8 insertions, 11 deletions

diff --git a/CHANGES b/CHANGES
index 404b9b018..56f07bd75 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,13 @@
 
                                   Changelog
 
+Daniel S (25 April 2007)
+- Sonia Subramanian brought our attention to a problem that happens if you set
+  the CURLOPT_RESUME_FROM or CURLOPT_RANGE options and an existing connection
+  in the connection cache is closed to make room for the new one when you call
+  curl_easy_perform(). It would then wrongly free range-related data in the
+  connection close funtion.
+
 Yang Tse (25 April 2007)
 - Steve Little fixed compilation on VMS 64-bit mode
 
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 99fddefe1..8e55ca805 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -50,6 +50,6 @@ This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
  Song Ma, Dan Fandrich, Yang Tse, Jay Austin, Robert Iakobashvil,
- James Housley, Daniel Black, Steve Little
+ James Housley, Daniel Black, Steve Little, Sonia Subramanian
 
         Thanks! (and sorry if I forgot to mention someone)
diff --git a/lib/url.c b/lib/url.c
index 659b977d8..1953c886c 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1830,16 +1830,6 @@ CURLcode Curl_disconnect(struct connectdata *conn)
   Curl_expire(data, 0); /* shut off timers */
   Curl_hostcache_prune(data); /* kill old DNS cache entries */
 
-  /*
-   * The range string is usually freed in curl_done(), but we might
-   * get here *instead* if we fail prematurely. Thus we need to be able
-   * to free this resource here as well.
-   */
-  if(data->reqdata.rangestringalloc) {
-    free(data->reqdata.range);
-    data->reqdata.rangestringalloc = FALSE;
-  }
-
   if((conn->ntlm.state != NTLMSTATE_NONE) ||
      (conn->proxyntlm.state != NTLMSTATE_NONE)) {
     /* Authentication data is a mix of connection-related and sessionhandle-