From bcb19883a8e422f3e32a740a3cd68c2d34bff100 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 28 Jan 2014 20:39:25 +0100 Subject: TFTP: fix crash on time-out tftp_done() can get called with its TFTP state pointer still being NULL on an early time-out, which caused a segfault when dereferenced. Reported-by: Glenn Sheridan Bug: http://curl.haxx.se/mail/lib-2014-01/0246.html --- lib/tftp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/tftp.c b/lib/tftp.c index 5b473d706..269d10f7a 100644 --- a/lib/tftp.c +++ b/lib/tftp.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2013, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2014, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -1041,7 +1041,8 @@ static CURLcode tftp_done(struct connectdata *conn, CURLcode status, return CURLE_ABORTED_BY_CALLBACK; /* If we have encountered an error */ - code = tftp_translate_code(state->error); + if(state) + code = tftp_translate_code(state->error); return code; } -- cgit v1.2.3