Kjetil Jacobsen found out that setting CURLOPT_MAXCONNECTS to a value higher

than 5 could cause a segfault.

diff --git a/lib/url.c b/lib/url.c
index 0836b24ab5519f94596bc8d0e0b4a1ac259a009c..865c247d5a8ced49bb3ff44141c2b352ce0efbd1 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -378,12 +378,19 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, ...)
           Curl_disconnect(data->state.connects[i]);
       }
       if(newconnects) {
+        int i;
         newptr= (struct connectdata **)
           realloc(data->state.connects,
                   sizeof(struct connectdata *) * newconnects);
         if(!newptr)
           /* we closed a few connections in vain, but so what? */
           return CURLE_OUT_OF_MEMORY;
+
+        /* nullify the newly added pointers */
+        for(i=data->state.numconnects; i<newconnects; i++) {
+          newptr[i] = NULL;
+        }
+
         data->state.connects = newptr;
         data->state.numconnects = newconnects;
       }