From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 28 Jan 2014 19:39:25 +0000 (+0100)
Subject: TFTP: fix crash on time-out
X-Git-Tag: curl-7_35_0~8
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bcb19883a8e422f3e32a740a3cd68c2d34bff100;p=curl

TFTP: fix crash on time-out

tftp_done() can get called with its TFTP state pointer still being NULL
on an early time-out, which caused a segfault when dereferenced.

Reported-by: Glenn Sheridan
Bug: http://curl.haxx.se/mail/lib-2014-01/0246.html
---

diff --git a/lib/tftp.c b/lib/tftp.c
index 5b473d706..269d10f7a 100644
--- a/lib/tftp.c
+++ b/lib/tftp.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -1041,7 +1041,8 @@ static CURLcode tftp_done(struct connectdata *conn, CURLcode status,
     return CURLE_ABORTED_BY_CALLBACK;
 
   /* If we have encountered an error */
-  code = tftp_translate_code(state->error);
+  if(state)
+    code = tftp_translate_code(state->error);
 
   return code;
 }