- Andre Guibert de Bruet pointed out a missing return code check for a

  strdup() that could lead to segfault if it returned NULL. I extended his
  suggest patch to now have Curl_retry_request() return a regular return code
  and better check that.

1 files changed, 16 insertions, 3 deletions

diff --git a/lib/multi.c b/lib/multi.c
index 1099b525d..686372ad1 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -1183,7 +1183,16 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
           char *newurl;
           followtype follow=FOLLOW_NONE;
           CURLcode drc;
-          bool retry = Curl_retry_request(easy->easy_conn, &newurl);
+          bool retry = FALSE;
+
+          drc = Curl_retry_request(easy->easy_conn, &newurl);
+          if(drc) {
+            /* a failure here pretty much implies an out of memory */
+            easy->result = drc;
+            disconnect_conn = TRUE;
+          }
+          else
+            retry = newurl?TRUE:FALSE;
 
           Curl_posttransfer(easy->easy_handle);
           drc = Curl_done(&easy->easy_conn, easy->result, FALSE);
@@ -1370,9 +1379,13 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
       }
       else if(TRUE == done) {
         char *newurl;
-        bool retry = Curl_retry_request(easy->easy_conn, &newurl);
+        bool retry = FALSE;
         followtype follow=FOLLOW_NONE;
 
+        easy->result = Curl_retry_request(easy->easy_conn, &newurl);
+        if(!easy->result)
+          retry = newurl?TRUE:FALSE;
+
         /* call this even if the readwrite function returned error */
         Curl_posttransfer(easy->easy_handle);
 
@@ -1406,7 +1419,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
             multistate(easy, CURLM_STATE_CONNECT);
             result = CURLM_CALL_MULTI_PERFORM;
           }
-          else
+          else if(newurl)
             /* Since we "took it", we are in charge of freeing this on
                failure */
             free(newurl);