[PATCH] http: clear POSTFIELDS when initializing a slot

Junio C Hamano· Apr 26, 2011, 15:28 UTC · lore

After posting a short request using CURLOPT_POSTFIELDS, if the slot is reused for posting a large payload, the slot ends up having both POSTFIELDS (which now points at a random garbage) and READFUNCTION, in which case the curl library tries to use the stale POSTFIELDS.

Clear it as part of the general slot initialization in get_active_slot().

Heavylifting-by: Shawn Pearce <spearce@spearce.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---

 * This came up while Shawn was looking at the smart HTTP code again.  It
   makes me wonder why we do not use curl_easy_reset() in this function,
   though...

 http.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

Show changes to http.c +1 −0

diff --git a/http.c b/http.c
index ed6414a..b642eac 100644
--- a/http.c
+++ b/http.c
@@ -494,6 +494,7 @@ struct active_request_slot *get_active_slot(void)
 	curl_easy_setopt(slot->curl, CURLOPT_CUSTOMREQUEST, NULL);
 	curl_easy_setopt(slot->curl, CURLOPT_READFUNCTION, NULL);
 	curl_easy_setopt(slot->curl, CURLOPT_WRITEFUNCTION, NULL);
+	curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDS, NULL);
 	curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0);
 	curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1);

-- 
1.7.5

Shawn Pearce· Apr 26, 2011, 16:18 UTC · re: Junio C Hamano · lore

Re: [PATCH] http: clear POSTFIELDS when initializing a slot

On Tue, Apr 26, 2011 at 08:28, Junio C Hamano <gitster@pobox.com> wrote:

Show 9 quoted lines

> After posting a short request using CURLOPT_POSTFIELDS, if the slot
> is reused for posting a large payload, the slot ends up having both
> POSTFIELDS (which now points at a random garbage) and READFUNCTION,
> in which case the curl library tries to use the stale POSTFIELDS.
>
> Clear it as part of the general slot initialization in get_active_slot().
>
> Heavylifting-by: Shawn Pearce <spearce@spearce.org>
> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Acked-by: Shawn Pearce <spearce@spearce.org>

FWIW, this bug exists since Git 1.6.6, when smart HTTP was first introduced. We just get lucky most of the time up until 1.7.4, and usually never have a failure, as fetch-pack/upload-pack negotiation packets are almost always smaller than the http.postbuffer size. Between 1.6.6 and 1.7.4, if it exceeds the postbuffer size, it may not be possible to fetch because the prior POSTFIELDS will be sent, which means the client will never transmit "done" and get a pack.

In 1.7.5 smart HTTP push is horribly broken without this patch.

>  * This came up while Shawn was looking at the smart HTTP code again.  It
>   makes me wonder why we do not use curl_easy_reset() in this function,
>   though...

Yea, makes me wonder too. :-)

Show 11 quoted lines

> diff --git a/http.c b/http.c
> index ed6414a..b642eac 100644
> --- a/http.c
> +++ b/http.c
> @@ -494,6 +494,7 @@ struct active_request_slot *get_active_slot(void)
>        curl_easy_setopt(slot->curl, CURLOPT_CUSTOMREQUEST, NULL);
>        curl_easy_setopt(slot->curl, CURLOPT_READFUNCTION, NULL);
>        curl_easy_setopt(slot->curl, CURLOPT_WRITEFUNCTION, NULL);
> +       curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDS, NULL);
>        curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0);
>        curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1);

-- 
Shawn.

patchhttp: clear POSTFIELDS when initializing a slot