Sonia Subramanian brought our attention to a problem that happens if you set

the CURLOPT_RESUME_FROM or CURLOPT_RANGE options and an existing connection
in the connection cache is closed to make room for the new one when you call
curl_easy_perform(). It would then wrongly free range-related data in the
connection close funtion.

1 files changed, 0 insertions, 10 deletions

diff --git a/lib/url.c b/lib/url.c
index 659b977d8..1953c886c 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1830,16 +1830,6 @@ CURLcode Curl_disconnect(struct connectdata *conn)
   Curl_expire(data, 0); /* shut off timers */
   Curl_hostcache_prune(data); /* kill old DNS cache entries */
 
-  /*
-   * The range string is usually freed in curl_done(), but we might
-   * get here *instead* if we fail prematurely. Thus we need to be able
-   * to free this resource here as well.
-   */
-  if(data->reqdata.rangestringalloc) {
-    free(data->reqdata.range);
-    data->reqdata.rangestringalloc = FALSE;
-  }
-
   if((conn->ntlm.state != NTLMSTATE_NONE) ||
      (conn->proxyntlm.state != NTLMSTATE_NONE)) {
     /* Authentication data is a mix of connection-related and sessionhandle-