Frank Hempel fixed a curl_easy_duphandle() crash on a handle that had

been removed from a multi handle, and then fixed another flaw that prevented
curl_easy_duphandle() to work even after the first fix - the handle was
still marked as using the multi interface.

3 files changed, 15 insertions, 3 deletions

diff --git a/CHANGES b/CHANGES
index d19a74d1f..d1c070fd6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,12 @@
 
                                   Changelog
 
+Daniel S (28 April 2007)
+- Frank Hempel fixed a curl_easy_duphandle() crash on a handle that had
+  been removed from a multi handle, and then fixed another flaw that prevented
+  curl_easy_duphandle() to work even after the first fix - the handle was
+  still marked as using the multi interface.
+
 Daniel S (26 April 2007)
 - Peter O'Gorman found a problem with SCP downloads when the downloaded file
   was 16385 bytes (16K+1) and it turned out we didn't properly always "suck
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 33ea5a859..09d56b7c7 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -30,6 +30,7 @@ This release includes the following bugfixes:
  o bad warning from configure when gnutls was selected
  o compilation on VMS 64-bit mode
  o SCP/SFTP downloads could hang on the last bytes of a transfer
+ o curl_easy_duphandle() crash
 
 This release includes the following known bugs:
 
@@ -52,6 +53,7 @@ This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
  Song Ma, Dan Fandrich, Yang Tse, Jay Austin, Robert Iakobashvil,
- James Housley, Daniel Black, Steve Little, Sonia Subramanian, Peter O'Gorman
+ James Housley, Daniel Black, Steve Little, Sonia Subramanian, Peter O'Gorman,
+ Frank Hempel
 
         Thanks! (and sorry if I forgot to mention someone)
diff --git a/lib/easy.c b/lib/easy.c
index 939966dde..8f590c97b 100644
--- a/lib/easy.c
+++ b/lib/easy.c
@@ -511,6 +511,10 @@ void Curl_easy_addmulti(struct SessionHandle *data,
                         void *multi)
 {
   data->multi = multi;
+  if (multi == NULL)
+    /* the association is cleared, mark the easy handle as not used by an
+       interface */
+    data->state.used_interface = Curl_if_none;
 }
 
 void Curl_easy_initHandleData(struct SessionHandle *data)
@@ -636,8 +640,8 @@ CURL *curl_easy_duphandle(CURL *incurl)
 
   if(fail) {
     if(outcurl) {
-      if((outcurl->state.connc->type == CONNCACHE_PRIVATE) &&
-         outcurl->state.connc)
+      if(outcurl->state.connc &&
+         (outcurl->state.connc->type == CONNCACHE_PRIVATE))
         Curl_rm_connc(outcurl->state.connc);
       if(outcurl->state.headerbuff)
         free(outcurl->state.headerbuff);