Fixed an out of memory handling issue with HTTP pipelines.

3 files changed, 37 insertions, 31 deletions

diff --git a/lib/multi.c b/lib/multi.c
index 4b42981e8..c61958ea4 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -121,9 +121,9 @@ struct Curl_one_easy {
 #define CURL_MULTI_HANDLE 0x000bab1e
 
 #define GOOD_MULTI_HANDLE(x) \
-  ((x)&&(((struct Curl_multi *)x)->type == CURL_MULTI_HANDLE))
+  ((x)&&(((struct Curl_multi *)(x))->type == CURL_MULTI_HANDLE))
 #define GOOD_EASY_HANDLE(x) \
- (((struct SessionHandle *)x)->magic == CURLEASY_MAGIC_NUMBER)
+ (((struct SessionHandle *)(x))->magic == CURLEASY_MAGIC_NUMBER)
 
 /* This is the struct known as CURLM on the outside */
 struct Curl_multi {
@@ -180,7 +180,7 @@ static void add_closure(struct Curl_multi *multi,
 static int update_timer(struct Curl_multi *multi);
 
 #ifdef CURLDEBUG
-static const char *statename[]={
+static const char * const statename[]={
   "INIT",
   "CONNECT",
   "WAITRESOLVE",
@@ -896,29 +896,30 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
 
       if(CURLE_OK == easy->result) {
         /* Add this handle to the send pipeline */
-        Curl_addHandleToPipeline(easy->easy_handle,
-                                 easy->easy_conn->send_pipe);
-
-        if(async)
-          /* We're now waiting for an asynchronous name lookup */
-          multistate(easy, CURLM_STATE_WAITRESOLVE);
-        else {
-          /* after the connect has been sent off, go WAITCONNECT unless the
-             protocol connect is already done and we can go directly to
-             WAITDO! */
-          result = CURLM_CALL_MULTI_PERFORM;
-
-          if(protocol_connect)
-            multistate(easy, CURLM_STATE_WAITDO);
-          else {
+        easy->result = Curl_addHandleToPipeline(easy->easy_handle,
+                                                easy->easy_conn->send_pipe);
+	if(CURLE_OK == easy->result) {
+	  if(async)
+	    /* We're now waiting for an asynchronous name lookup */
+	    multistate(easy, CURLM_STATE_WAITRESOLVE);
+	  else {
+	    /* after the connect has been sent off, go WAITCONNECT unless the
+	       protocol connect is already done and we can go directly to
+	       WAITDO! */
+	    result = CURLM_CALL_MULTI_PERFORM;
+
+	    if(protocol_connect)
+	      multistate(easy, CURLM_STATE_WAITDO);
+	    else {
 #ifndef CURL_DISABLE_HTTP
-            if (easy->easy_conn->bits.tunnel_connecting)
-              multistate(easy, CURLM_STATE_WAITPROXYCONNECT);
-            else
+	      if (easy->easy_conn->bits.tunnel_connecting)
+		multistate(easy, CURLM_STATE_WAITPROXYCONNECT);
+	      else
 #endif
-              multistate(easy, CURLM_STATE_WAITCONNECT);
-          }
-        }
+		multistate(easy, CURLM_STATE_WAITCONNECT);
+	    }
+	  }
+	}
       }
       break;
 
@@ -1153,8 +1154,8 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
       Curl_removeHandleFromPipeline(easy->easy_handle,
                                     easy->easy_conn->send_pipe);
       /* Add ourselves to the recv pipeline */
-      Curl_addHandleToPipeline(easy->easy_handle,
-                               easy->easy_conn->recv_pipe);
+      easy->result = Curl_addHandleToPipeline(easy->easy_handle,
+                                              easy->easy_conn->recv_pipe);
       multistate(easy, CURLM_STATE_WAITPERFORM);
       result = CURLM_CALL_MULTI_PERFORM;
 
diff --git a/lib/url.c b/lib/url.c
index 5ebc9e8b9..4b8c53399 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1925,8 +1925,8 @@ static bool IsPipeliningEnabled(struct SessionHandle *handle)
   return FALSE;
 }
 
-void Curl_addHandleToPipeline(struct SessionHandle *data,
-                              struct curl_llist *pipe)
+CURLcode Curl_addHandleToPipeline(struct SessionHandle *data,
+                                  struct curl_llist *pipe)
 {
 #ifdef CURLDEBUG
   if(!IsPipeliningPossible(data)) {
@@ -1935,7 +1935,9 @@ void Curl_addHandleToPipeline(struct SessionHandle *data,
       infof(data, "PIPE when no PIPE supposed!\n");
   }
 #endif
-  Curl_llist_insert_next(pipe, pipe->tail, data);
+  if (!Curl_llist_insert_next(pipe, pipe->tail, data))
+    return CURLE_OUT_OF_MEMORY;
+  return CURLE_OK;
 }
 
 
@@ -1995,6 +1997,9 @@ static void signalPipeClose(struct curl_llist *pipe)
 {
   struct curl_llist_element *curr;
 
+  if (!pipe)
+    return;
+
   curr = pipe->head;
   while (curr) {
     struct curl_llist_element *next = curr->next;
diff --git a/lib/url.h b/lib/url.h
index 4db324ad4..9f92e693b 100644
--- a/lib/url.h
+++ b/lib/url.h
@@ -62,8 +62,8 @@ int Curl_doing_getsock(struct connectdata *conn,
                        curl_socket_t *socks,
                        int numsocks);
 
-void Curl_addHandleToPipeline(struct SessionHandle *handle,
-                              struct curl_llist *pipe);
+CURLcode Curl_addHandleToPipeline(struct SessionHandle *handle,
+                                  struct curl_llist *pipe);
 int Curl_removeHandleFromPipeline(struct SessionHandle *handle,
                                   struct curl_llist *pipe);
 bool Curl_isHandleAtHead(struct SessionHandle *handle,