From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 18 Jun 2013 06:36:59 GMT
Subject: Re: [PATCH] http.c: don't rewrite the user:passwd string multiple times
Message-ID: <alpine.DEB.2.00.1306180825460.24456@tvnag.unkk.fr>
In-Reply-To: <20130618051902.GA5916@sigill.intra.peff.net>

On Tue, 18 Jun 2013, Jeff King wrote:

TL;DR: I'm just confirming what's said here! =)

> My understanding of curl's pointer requirements are:
>
>  1. Older versions of curl (and I do not recall which version off-hand,
>     but it is not important) stored just the pointer. Calling code was
>     required to manage the string lifetime itself.
>
>  2. Newer versions of curl will strdup the string in curl_easy_setopt.

That's correct. This "new" behavior in (2) was introduced in libcurl 7.17.0 - 
released in September 2007 and should thus be fairly rare by now.

I mention this primarily because I think it should be noted that there will 
probably be very little testing by users with such old libcurl versions. It 
may increase the time between a committed change and people notice brekages 
caused by it. Even Debian old-stable has a much newer version.

> For older versions, if we were to grow the strbuf, we might free() the 
> pointer provided to an earlier call to curl_easy_setopt. But since we are 
> about to call curl_easy_setopt with the new value, I would assume that curl 
> will never actually look at the old one (i.e., when replacing an old 
> pointer, it would not dereference it, but simply overwrite it with the new 
> value).

Another accurate description.

-- 

  / daniel.haxx.se