Hi,

I have discovered a crash within curl 7.34.0 where we try to download a tftp 
file and the resolution timeout expires.

The crash occurs in tftp_done when trying to access state->error as state is 
NULL at this point.

A normal flow for tftp is the following:
tftp_connect -> tftp_do -> tftp_perform -> tftp_done

When the timeout expires in multi.c, the tftp_connect is not called and state 
is not initialised. The code then tries to go through tftp_done and the crash 
occours.

A simple fix for this would be to check for NULL in tftp_done.

I'm not sure if I need to open a bug against this or if I can be more help.


-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html

Reply via email to