From ad0aa27a9dfd027ffb62b86dfe8a09feb0fee0d8 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 11 Jan 2020 22:53:34 +0100
Subject: curl: remove 'config' field from OutStruct

As it was just unnecessary duplicated information already stored in the
'per_transfer' struct and that's around mostly anyway.

The duplicated pointer caused problems when the code flow was aborted
before the dupe was filled in and could cause a NULL pointer access.

Reported-by: Brian Carpenter
Fixes #4807
Closes #4810
---
 src/tool_cb_hdr.c | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

(limited to 'src/tool_cb_hdr.c')

diff --git a/src/tool_cb_hdr.c b/src/tool_cb_hdr.c
index 77224adba..30d7c99ae 100644
--- a/src/tool_cb_hdr.c
+++ b/src/tool_cb_hdr.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -73,12 +73,12 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
    */
   size_t failure = (size && nmemb) ? 0 : 1;
 
-  if(!heads->config)
+  if(!per->config)
     return failure;
 
 #ifdef DEBUGBUILD
   if(size * nmemb > (size_t)CURL_MAX_HTTP_HEADER) {
-    warnf(heads->config->global, "Header data exceeds single call write "
+    warnf(per->config->global, "Header data exceeds single call write "
           "limit!\n");
     return failure;
   }
@@ -88,7 +88,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
    * Write header data when curl option --dump-header (-D) is given.
    */
 
-  if(heads->config->headerfile && heads->stream) {
+  if(per->config->headerfile && heads->stream) {
     size_t rc = fwrite(ptr, size, nmemb, heads->stream);
     if(rc != cb)
       return rc;
@@ -100,7 +100,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
    * Write etag to file when --etag-save option is given.
    * etag string that we want is enveloped in double quotes
    */
-  if(etag_save->config->etag_save_file && etag_save->stream) {
+  if(per->config->etag_save_file && etag_save->stream) {
     /* match only header that start with etag (case insensitive) */
     if(curl_strnequal(str, "etag:", 5)) {
       char *etag_h = NULL;
@@ -118,9 +118,8 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
        */
 
       if(!first) {
-        warnf(
-          etag_save->config->global,
-          "\nReceived header etag is missing double quote/s\n");
+        warnf(per->config->global,
+              "\nReceived header etag is missing double quote/s\n");
         return 1;
       }
       else {
@@ -132,9 +131,8 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
       last = memchr(first, '\"', cb);
 
       if(!last) {
-        warnf(
-          etag_save->config->global,
-          "\nReceived header etag is missing double quote/s\n");
+        warnf(per->config->global,
+              "\nReceived header etag is missing double quote/s\n");
         return 1;
       }
 
@@ -197,7 +195,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
           /* rename the initial file name to the new file name */
           rc = rename(outs->filename, filename);
           if(rc != 0) {
-            warnf(outs->config->global, "Failed to rename %s -> %s: %s\n",
+            warnf(per->config->global, "Failed to rename %s -> %s: %s\n",
                   outs->filename, filename, strerror(errno));
           }
           if(outs->alloc_filename)
@@ -213,12 +211,12 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
         outs->filename = filename;
         outs->alloc_filename = TRUE;
         hdrcbdata->honor_cd_filename = FALSE; /* done now! */
-        if(!tool_create_output_file(outs))
+        if(!tool_create_output_file(outs, per->config))
           return failure;
       }
       break;
     }
-    if(!outs->stream && !tool_create_output_file(outs))
+    if(!outs->stream && !tool_create_output_file(outs, per->config))
       return failure;
   }
 
@@ -228,7 +226,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
     /* bold headers only for selected protocols */
     char *value = NULL;
 
-    if(!outs->stream && !tool_create_output_file(outs))
+    if(!outs->stream && !tool_create_output_file(outs, per->config))
       return failure;
 
     if(hdrcbdata->global->isatty && hdrcbdata->global->styled_output)
-- 
cgit v1.2.3