1From 55e1875729f9d9fc7315cec611bffbd2c817ad89 Mon Sep 17 00:00:00 2001 2From: Daniel Stenberg <daniel@haxx.se> 3Date: Thu, 6 Oct 2022 14:13:36 +0200 4Subject: [PATCH] http_proxy: restore the protocol pointer on error 5 6Reported-by: Trail of Bits 7 8Closes #9790 9 10CVE: CVE-2022-42915 11Upstream-Status: Backport [https://github.com/curl/curl/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89] 12Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> 13--- 14 lib/http_proxy.c | 6 ++---- 15 lib/url.c | 9 --------- 16 2 files changed, 2 insertions(+), 13 deletions(-) 17 18diff --git a/lib/http_proxy.c b/lib/http_proxy.c 19index 1f87f6c62aa40..cc20b3a801941 100644 20--- a/lib/http_proxy.c 21+++ b/lib/http_proxy.c 22@@ -212,10 +212,8 @@ void Curl_connect_done(struct Curl_easy *data) 23 Curl_dyn_free(&s->rcvbuf); 24 Curl_dyn_free(&s->req); 25 26- /* restore the protocol pointer, if not already done */ 27- if(s->prot_save) 28- data->req.p.http = s->prot_save; 29- s->prot_save = NULL; 30+ /* restore the protocol pointer */ 31+ data->req.p.http = s->prot_save; 32 data->info.httpcode = 0; /* clear it as it might've been used for the 33 proxy */ 34 data->req.ignorebody = FALSE; 35diff --git a/lib/url.c b/lib/url.c 36index 690c53c81a3c1..be5ffca2d8b20 100644 37--- a/lib/url.c 38+++ b/lib/url.c 39@@ -751,15 +751,6 @@ static void conn_shutdown(struct Curl_easy *data, struct connectdata *conn) 40 DEBUGASSERT(data); 41 infof(data, "Closing connection %ld", conn->connection_id); 42 43-#ifndef USE_HYPER 44- if(conn->connect_state && conn->connect_state->prot_save) { 45- /* If this was closed with a CONNECT in progress, cleanup this temporary 46- struct arrangement */ 47- data->req.p.http = NULL; 48- Curl_safefree(conn->connect_state->prot_save); 49- } 50-#endif 51- 52 /* possible left-overs from the async name resolvers */ 53 Curl_resolver_cancel(data); 54