curl/curl-invalid-free.patch

From 19e775b499c5c3cc7ec717af7c1e764f42817369 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sun, 18 Jun 2017 17:54:55 +0200
Subject: [PATCH] PIPELINING_SERVER_BL: cleanup the internal list use

The list was freed incorrectly since the llist refactor of
cbae73e1dd959. Aded test 1550 to verify that it works and avoid future
regressions.

Reported-by: Pascal Terjan

Fixes #1584
---
 lib/pipeline.c             | 37 +++++++++++++++----------------------
 tests/data/Makefile.inc    |  1 +
 tests/data/test1550        | 29 +++++++++++++++++++++++++++++
 tests/libtest/Makefile.inc |  8 ++++++++
 tests/libtest/lib1550.c    | 39 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 92 insertions(+), 22 deletions(-)
 create mode 100644 tests/data/test1550
 create mode 100644 tests/libtest/lib1550.c

diff --git a/lib/pipeline.c b/lib/pipeline.c
index b8d2037452..4d41b04139 100644
--- a/lib/pipeline.c
+++ b/lib/pipeline.c
@@ -230,28 +230,27 @@ CURLMcode Curl_pipeline_set_site_blacklist(char **sites,
   return CURLM_OK;
 }
 
+struct blacklist_node {
+  struct curl_llist_element list;
+  char server_name[1];
+};
+
 bool Curl_pipeline_server_blacklisted(struct Curl_easy *handle,
                                       char *server_name)
 {
   if(handle->multi && server_name) {
-    struct curl_llist *blacklist =
+    struct curl_llist *list =
       Curl_multi_pipelining_server_bl(handle->multi);
 
-    if(blacklist) {
-      struct curl_llist_element *curr;
-
-      curr = blacklist->head;
-      while(curr) {
-        char *bl_server_name;
-
-        bl_server_name = curr->ptr;
-        if(strncasecompare(bl_server_name, server_name,
-                           strlen(bl_server_name))) {
-          infof(handle, "Server %s is blacklisted\n", server_name);
-          return TRUE;
-        }
-        curr = curr->next;
+    struct curl_llist_element *e = list->head;
+    while(e) {
+      struct blacklist_node *bl = (struct blacklist_node *)e;
+      if(strncasecompare(bl->server_name, server_name,
+                         strlen(bl->server_name))) {
+        infof(handle, "Server %s is blacklisted\n", server_name);
+        return TRUE;
       }
+      e = e->next;
     }
 
     DEBUGF(infof(handle, "Server %s is not blacklisted\n", server_name));
@@ -259,11 +258,6 @@ bool Curl_pipeline_server_blacklisted(struct Curl_easy *handle,
   return FALSE;
 }
 
-struct blacklist_node {
-  struct curl_llist_element list;
-  char server_name[1];
-};
-
 CURLMcode Curl_pipeline_set_server_blacklist(char **servers,
                                              struct curl_llist *list)
 {
@@ -286,8 +280,7 @@ CURLMcode Curl_pipeline_set_server_blacklist(char **servers,
       }
       strcpy(n->server_name, *servers);
 
-      Curl_llist_insert_next(list, list->tail, n->server_name,
-                             &n->list);
+      Curl_llist_insert_next(list, list->tail, n, &n->list);
       servers++;
     }
   }