Bug 1724292

Created attachment 1584864 [details]
Modified fopen.c example causing segmentation fault

If the curl_easy_setopt(curl_h, CURLOPT_BUFFERSIZE, 128000L); is used to set preferred buffer size using libcurl-7.29.0-51.el7.x86_64 (CentOS 7.6.1810), the curl_easy_setopt() may cause segmentation fault.

It was OK in the previous version of the libcurl-7.29.0-46.el7.x86_64 (CentOS 7.5.1804).

To reproduce download CURL example https://curl.haxx.se/libcurl/c/fopen.html and add line 256:

254 curl_easy_setopt(file->handle.curl, CURLOPT_VERBOSE, 0L);
255 curl_easy_setopt(file->handle.curl, CURLOPT_WRITEFUNCTION, write_callback);
256 curl_easy_setopt(file->handle.curl, CURLOPT_BUFFERSIZE, 128000L);
257 
258 if(!multi_handle)
259 multi_handle = curl_multi_init();

The application will crash trying to get any big URL, for example:

bash-4.2$ gcc -o /tmp/fopen -lcurl /tmp/fopen.c
bash-4.2$ ldd /tmp/fopen | grep curl
    libcurl.so.4 => /lib64/libcurl.so.4 (0x00007feaefcb3000)
bash-4.2$ ls -la /lib64/libcurl.so.4
lrwxrwxrwx 1 root root 16 Jun 25 12:39 /lib64/libcurl.so.4 -> libcurl.so.4.3.0
bash-4.2$ rpm -qf /lib64/libcurl.so.4.3.0
libcurl-7.29.0-51.el7.x86_64
bash-4.2$ gdb --args /tmp/fopen http://212.183.159.230/5MB.zip
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-114.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /tmp/fopen...(no debugging symbols found)...done.
(gdb) run
Starting program: /tmp/fopen http://212.183.159.230/5MB.zip
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bada20 in Curl_splay () from /lib64/libcurl.so.4
Missing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.26-23.el7.x86_64 glibc-2.17-260.el7_6.5.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 krb5-libs-1.15.1-37.el7_6.x86_64 libcom_err-1.42.9-13.el7.x86_64 libcurl-7.29.0-51.el7.x86_64 libidn-1.28-4.el7.x86_64 libselinux-2.5-14.1.el7.x86_64 libssh2-1.4.3-12.el7_6.2.x86_64 nspr-4.19.0-1.el7_5.x86_64 nss-3.36.0-7.1.el7_6.cern.x86_64 nss-softokn-freebl-3.36.0-5.el7_5.x86_64 nss-util-3.36.0-1.1.el7_6.x86_64 openldap-2.4.44-21.el7_6.x86_64 openssl-libs-1.0.2k-16.el7_6.1.x86_64 pcre-8.32-17.el7.x86_64 zlib-1.2.7-18.el7.x86_64
(gdb) where
#0 0x00007ffff7bada20 in Curl_splay () from /lib64/libcurl.so.4
#1 0x00007ffff7badc21 in Curl_splaygetbest () from /lib64/libcurl.so.4
#2 0x00007ffff7ba6425 in curl_multi_perform () from /lib64/libcurl.so.4
#3 0x000000000040129f in fill_buffer ()
#4 0x00000000004017cf in url_fgets ()
#5 0x00000000004019fa in main ()

Commenting line 256 out makes program working normally.

---

See also original post in https://bugs.centos.org/view.php?id=16218