Properly cleanup in http_cleanup so builtin-fetch does not segfault

Junio and I both noticed that the new builtin-fetch was segfaulting
immediately on http/https/ftp style URLs (those that went through
libcurl and the commit walker).  Although the builtin-fetch changes
in this area were really just minor refactorings there was one major
change made: we invoked http_init(), http_cleanup() then http_init()
again in the same process.

When we call curl_easy_cleanup() on each active_request_slot we
are telling libcurl we did not want that buffer to be used again.
Unfortunately we did not also deallocate the active_request_slot
itself nor did we NULL out active_queue_head.  This lead us to
attempt to reuse these cleaned up libcurl handles when we later tried
to invoke http_init() a second time to reactivate the curl library.
The next file get operation then immediately segfaulted on most
versions of libcurl.

Properly freeing our own buffers and clearing the list causes us to
reinitialize the curl buffers again if/when we need to use libcurl
from within this same process.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/http.c b/http.c
index a95483be8b41664824b57883bcc4801ea0d10311..87ebf7b86548d229afbfd9263d2470296a7b2ac7 100644 (file)
--- a/http.c
+++ b/http.c
@@ -276,6 +276,7 @@ void http_cleanup(void)
 #endif
 
        while (slot != NULL) {
+               struct active_request_slot *next = slot->next;
 #ifdef USE_CURL_MULTI
                if (slot->in_use) {
                        curl_easy_getinfo(slot->curl,
@@ -287,8 +288,10 @@ void http_cleanup(void)
 #endif
                if (slot->curl != NULL)
                        curl_easy_cleanup(slot->curl);
-               slot = slot->next;
+               free(slot);
+               slot = next;
        }
+       active_queue_head = NULL;
 
 #ifndef NO_CURL_EASY_DUPHANDLE
        curl_easy_cleanup(curl_default);
@@ -300,7 +303,7 @@ void http_cleanup(void)
        curl_global_cleanup();
 
        curl_slist_free_all(pragma_header);
-        pragma_header = NULL;
+       pragma_header = NULL;
 }
 
 struct active_request_slot *get_active_slot(void)