Markus Koetter filed debian bug report #355715 which identified a problem

with the multi interface and multi-part formposts. The fix from February
22nd could make the Curl_done() function get called twice on the same
connection and it was not designed for that and thus tried to call free() on
an already freed memory area!

1 files changed, 6 insertions, 0 deletions

diff --git a/lib/url.c b/lib/url.c
index 4eeb1dc9a..9a715c9f0 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -3982,6 +3982,11 @@ CURLcode Curl_done(struct connectdata **connp,
   struct connectdata *conn = *connp;
   struct SessionHandle *data=conn->data;
 
+  if(conn->bits.done)
+    return CURLE_OK; /* Curl_done() has already been called */
+
+  conn->bits.done = TRUE; /* called just now! */
+
   /* cleanups done even if the connection is re-used */
   if(conn->bits.rangestringalloc) {
     free(conn->range);
@@ -4047,6 +4052,7 @@ CURLcode Curl_do(struct connectdata **connp, bool *done)
   struct connectdata *conn = *connp;
   struct SessionHandle *data=conn->data;
 
+  conn->bits.done = FALSE; /* Curl_done() is not called yet */
   conn->bits.do_more = FALSE; /* by default there's no curl_do_more() to use */
 
   if(conn->curl_do) {