- Jeff Pohlmeyer identified two problems: first a rather obscure problem with

  the multi interface and connection re-use that could make a
  curl_multi_remove_handle() ruin a pointer in another handle.

  The second problem was less of an actual problem but more of minor quirk:
  the re-using of connections wasn't properly checking if the connection was
  marked for closure.

3 files changed, 18 insertions, 16 deletions

diff --git a/lib/http.c b/lib/http.c
index 8b9e5665c..638c5fad2 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -1403,6 +1403,10 @@ CURLcode Curl_http_connect(struct connectdata *conn, bool *done)
 
   data=conn->data;
 
+  /* We default to persistent connections. We set this already in this connect
+     function to make the re-use checks properly be able to check this bit. */
+  conn->bits.close = FALSE;
+
   /* If we are not using a proxy and we want a secure connection, perform SSL
    * initialization & connection now.  If using a proxy with https, then we
    * must tell the proxy to CONNECT to the host we want to talk to.  Only
@@ -1674,9 +1678,6 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
   else
     http = data->reqdata.proto.http;
 
-  /* We default to persistent connections */
-  conn->bits.close = FALSE;
-
   if ( (conn->protocol&(PROT_HTTP|PROT_FTP)) &&
        data->set.upload) {
     httpreq = HTTPREQ_PUT;
diff --git a/lib/multi.c b/lib/multi.c
index d32172288..49db7d064 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -542,11 +542,10 @@ CURLMcode curl_multi_remove_handle(CURLM *multi_handle,
       easy->easy_handle->dns.hostcachetype = HCACHE_NONE;
     }
 
-    /* if we have a connection we must call Curl_done() here so that we
-       don't leave a half-baked one around */
-    if(easy->easy_conn) {
-      /* Set up the association right */
-      easy->easy_conn->data = easy->easy_handle;
+    /* we must call Curl_done() here (if we still "own it") so that we don't
+       leave a half-baked one around */
+    if(easy->easy_conn &&
+       (easy->easy_conn->data == easy->easy_handle)) {
 
       /* Curl_done() clears the conn->data field to lose the association
          between the easy handle and the connection */
diff --git a/lib/url.c b/lib/url.c
index 148d7b2bb..6d1fa0459 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -2030,7 +2030,8 @@ ConnectionExists(struct SessionHandle *data,
                                   from the multi */
     }
 
-    infof(data, "Examining connection #%ld for reuse\n", check->connectindex);
+    DEBUGF(infof(data, "Examining connection #%ld for reuse\n",
+                 check->connectindex));
 
     if(check->inuse && !canPipeline) {
       /* can only happen within multi handles, and means that another easy
@@ -2056,11 +2057,11 @@ ConnectionExists(struct SessionHandle *data,
       continue;
     }
 
-    if (data->state.is_in_pipeline && check->bits.close) {
-        /* Don't pick a connection that is going to be closed */
-        infof(data, "Connection #%ld has been marked for close, can't reuse\n",
-              check->connectindex);
-        continue;
+    if (check->bits.close) {
+      /* Don't pick a connection that is going to be closed. */
+      infof(data, "Connection #%ld has been marked for close, can't reuse\n",
+            check->connectindex);
+      continue;
     }
 
     if((needle->protocol&PROT_SSL) != (check->protocol&PROT_SSL))
@@ -4136,8 +4137,9 @@ CURLcode Curl_async_resolved(struct connectdata *conn,
 
 
 CURLcode Curl_done(struct connectdata **connp,
-                   CURLcode status, bool premature) /* an error if this is called after an
-                                       error was detected */
+                   CURLcode status,  /* an error if this is called after an
+                                        error was detected */
+                   bool premature)
 {
   CURLcode result;
   struct connectdata *conn = *connp;