Bug report #1830637 (http://curl.haxx.se/bug/view.cgi?id=1830637), which was

forwarded from the Gentoo bug tracker by Daniel Black and was originally
submitted by Robin Johnson, pointed out that libcurl would do bad memory
references when it failed and bailed out before the handler thing was
setup. My fix is not done like the provided patch does it, but instead I
make sure that there's never any chance for a NULL pointer in that struct
member.

3 files changed, 24 insertions, 8 deletions

diff --git a/CHANGES b/CHANGES
index ebf6ebd1b..0823cdcbc 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,11 +6,20 @@
 
                                   Changelog
 
+Daniel S (12 Nov 2007)
+- Bug report #1830637 (http://curl.haxx.se/bug/view.cgi?id=1830637), which was
+  forwarded from the Gentoo bug tracker by Daniel Black and was originally
+  submitted by Robin Johnson, pointed out that libcurl would do bad memory
+  references when it failed and bailed out before the handler thing was
+  setup. My fix is not done like the provided patch does it, but instead I
+  make sure that there's never any chance for a NULL pointer in that struct
+  member.
+
 Daniel S (8 Nov 2007)
 - Bug report #1823487 (http://curl.haxx.se/bug/view.cgi?id=1823487) pointed
   out that SFTP requests didn't use persistent connections. Neither did SCP
   ones.  I gave the SSH code a good beating and now both SCP and SFTP should
-  use persistent connections fine. I also did a bunch for indent changes as
+  use persistent connections fine. I also did a bunch of indent changes as
   well as a bug fix for the "keyboard interactive" auth.
 
 Dan F (6 Nov 2007)
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index f291ce4bf..ffe2e4431 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -19,6 +19,7 @@ This release includes the following bugfixes:
  o free problem in the curl tool for users with empty home dir
  o curl.h version 7.17.1 problem when building C++ apps with MSVC
  o SFTP and SCP use persistent connections
+ o segfault on bad URL
 
 This release includes the following known bugs:
 
@@ -36,6 +37,7 @@ New curl mirrors:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
- Dan Fandrich, Gisle Vanem, Toby Peterson, Yang Tse
+ Dan Fandrich, Gisle Vanem, Toby Peterson, Yang Tse, Daniel Black,
+ Robin Johnson
  
         Thanks! (and sorry if I forgot to mention someone)
diff --git a/lib/url.c b/lib/url.c
index 93d3bad34..3897925a9 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -2134,7 +2134,7 @@ CURLcode Curl_disconnect(struct connectdata *conn)
     Curl_ntlm_cleanup(conn);
   }
 
-  if(conn->handler && conn->handler->disconnect)
+  if(conn->handler->disconnect)
     /* This is set if protocol-specific cleanups should be made */
     conn->handler->disconnect(conn);
 
@@ -2668,7 +2668,7 @@ int Curl_doing_getsock(struct connectdata *conn,
                        curl_socket_t *socks,
                        int numsocks)
 {
-  if(conn && conn->handler && conn->handler->doing_getsock)
+  if(conn && conn->handler->doing_getsock)
     return conn->handler->doing_getsock(conn, socks, numsocks);
   return GETSOCK_BLANK;
 }
@@ -2684,7 +2684,7 @@ CURLcode Curl_protocol_connecting(struct connectdata *conn,
 {
   CURLcode result=CURLE_OK;
 
-  if(conn && conn->handler && conn->handler->connecting) {
+  if(conn && conn->handler->connecting) {
     *done = FALSE;
     result = conn->handler->connecting(conn, done);
   }
@@ -2703,7 +2703,7 @@ CURLcode Curl_protocol_doing(struct connectdata *conn, bool *done)
 {
   CURLcode result=CURLE_OK;
 
-  if(conn && conn->handler && conn->handler->doing) {
+  if(conn && conn->handler->doing) {
     *done = FALSE;
     result = conn->handler->doing(conn, done);
   }
@@ -3111,8 +3111,9 @@ static CURLcode setup_connection_internals(struct SessionHandle *data,
       return CURLE_OK;
     }
 
-  /* Protocol not found in table. */
-  conn->handler = &Curl_handler_dummy;  /* Be sure we have a handler defined. */
+  /* Protocol not found in table, but we don't have to assign it to anything
+     since it is already assign to a dummy-struct in the CreateConnection()
+     struct when the connectdata struct is allocated. */
   failf(data, "Protocol %s not supported or disabled in " LIBCURL_NAME,
         conn->protostr);
   return CURLE_UNSUPPORTED_PROTOCOL;
@@ -3470,6 +3471,10 @@ static CURLcode CreateConnection(struct SessionHandle *data,
      any failure */
   *in_connect = conn;
 
+  conn->handler = &Curl_handler_dummy;  /* Be sure we have a handler defined
+                                           already from start to avoid NULL
+                                           situations and checks */
+
   /* and we setup a few fields in case we end up actually using this struct */
 
   conn->data = data; /* Setup the association between this connection