Created attachment 1689514 [details]
reproducer

Description of problem:
POST followed by a GET with large headers on the same connection leads to a NULL dereference and segfaults.

Version-Release number of selected component (if applicable):
libcurl-7.29.0-57.el7.x86_64

How reproducible:


Steps to Reproduce:
1. yum install libcurl
2. ./post-get-crash

Then it crashes as follows:

Program terminated with signal 11, Segmentation fault.
#0  __GI__IO_fread (buf=0x1e248d8, size=1, count=16384, fp=0x0) at iofread.c:37
warning: Source file is more recent than executable.
37        _IO_acquire_lock (fp);
(gdb) bt
#0  __GI__IO_fread (buf=0x1e248d8, size=1, count=16384, fp=0x0) at iofread.c:37
#1  0x00007f59f5f72373 in Curl_fillreadbuffer (conn=conn@entry=0x1e43fc0, bytes=bytes@entry=16384, nreadp=nreadp@entry=0x7ffc2ecf1cf0) at transfer.c:120
#2  0x00007f59f5f72f4f in readwrite_upload (didwhat=<synthetic pointer>, k=0x1e24030, conn=0x1e43fc0, data=0x1e24000) at transfer.c:841
#3  Curl_readwrite (conn=0x1e43fc0, done=done@entry=0x7ffc2ecf1d6f) at transfer.c:1034
#4  0x00007f59f5f7cc3b in multi_runsingle (multi=multi@entry=0x1e2ce00, now=..., easy=easy@entry=0x1ef9800) at multi.c:1485
#5  0x00007f59f5f7d5e1 in curl_multi_perform (multi_handle=multi_handle@entry=0x1e2ce00, running_handles=running_handles@entry=0x7ffc2ecf1e60) at multi.c:1763
#6  0x00007f59f5f747f3 in curl_easy_perform (easy=0x1e24000) at easy.c:480
#7  0x0000000000400cca in send_get (handle=0x1e24000) at post-get-crash.c:82
#8  0x0000000000400d78 in main (argc=1, argv=0x7ffc2ecf2bc8) at post-get-crash.c:111

In the frame 0, fp=0 causes segfault.

Actual results:


Expected results:


Additional info: