Skip to content

Commit

Permalink
select: avoid a NULL deref in cwfds_add_sock
Browse files Browse the repository at this point in the history
curl_multi_waitfds(m, NULL, ...);

=> Curl_waitfds_init(&cwfds, ufds, size);

=> Curl_waitfds_add_ps(&cwfds);

=>   cwfds_add_sock(cwfds, ...);

Would then try to use the ->wfds array while set to NULL previously.
This should not happen, which this is now also protected with an assert
to trigger debug builds if it happens.

Caught by CodeSonar

Assisted-by: Jay Satiro

Closes curl#15881
  • Loading branch information
bagder committed Jan 1, 2025
1 parent 26a6722 commit af4e859
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion lib/select.c
Original file line number Diff line number Diff line change
Expand Up @@ -503,7 +503,10 @@ static unsigned int cwfds_add_sock(struct curl_waitfds *cwfds,
curl_socket_t sock, short events)
{
int i;

if(!cwfds->wfds) {
DEBUGASSERT(!cwfds->count && !cwfds->n);
return 1;
}
if(cwfds->n <= INT_MAX) {
for(i = (int)cwfds->n - 1; i >= 0; --i) {
if(sock == cwfds->wfds[i].fd) {
Expand Down

0 comments on commit af4e859

Please sign in to comment.