aboutsummaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2016-02-23 13:05:41 +0100
committerDaniel Stenberg <daniel@haxx.se>2016-02-23 13:08:11 +0100
commit3438ce7f468e837f98f51b798da15ff0a836cf43 (patch)
tree4368d2fdece92b3996079a3fbfdd97bc0c4185ca /lib
parenteffa575fc7f028ee71fda16209d3d81af336b730 (diff)
multi_remove_handle: keep the timeout list until after disconnect
The internal Curl_done() function uses Curl_expire() at times and that uses the timeout list. Better clean up the list once we're done using it. This caused a segfault. Reported-by: 蔡文凱 Bug: https://curl.haxx.se/mail/lib-2016-02/0097.html
Diffstat (limited to 'lib')
-rw-r--r--lib/multi.c15
1 files changed, 8 insertions, 7 deletions
diff --git a/lib/multi.c b/lib/multi.c
index 069412d4e..ad7d21fea 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -537,12 +537,6 @@ CURLMcode curl_multi_remove_handle(CURLM *multi_handle,
curl_easy_cleanup is called. */
Curl_expire(data, 0);
- /* destroy the timeout list that is held in the easy handle */
- if(data->state.timeoutlist) {
- Curl_llist_destroy(data->state.timeoutlist, NULL);
- data->state.timeoutlist = NULL;
- }
-
if(data->dns.hostcachetype == HCACHE_MULTI) {
/* stop using the multi handle's DNS cache */
data->dns.hostcache = NULL;
@@ -569,6 +563,13 @@ CURLMcode curl_multi_remove_handle(CURLM *multi_handle,
Curl_wildcard_dtor(&data->wildcard);
+ /* destroy the timeout list that is held in the easy handle, do this *after*
+ Curl_done() as that may actuall call Curl_expire that uses this */
+ if(data->state.timeoutlist) {
+ Curl_llist_destroy(data->state.timeoutlist, NULL);
+ data->state.timeoutlist = NULL;
+ }
+
/* as this was using a shared connection cache we clear the pointer to that
since we're not part of that multi handle anymore */
data->state.conn_cache = NULL;