[PATCH] http: clear POSTFIELDS when initializing a slot

[PATCH] http: clear POSTFIELDS when initializing a slot

[Junio C Hamano]

After posting a short request using CURLOPT_POSTFIELDS, if the slot
is reused for posting a large payload, the slot ends up having both
POSTFIELDS (which now points at a random garbage) and READFUNCTION,
in which case the curl library tries to use the stale POSTFIELDS.

Clear it as part of the general slot initialization in get_active_slot().

Heavylifting-by: Shawn Pearce <spearce@spearce.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---

 * This came up while Shawn was looking at the smart HTTP code again.  It
   makes me wonder why we do not use curl_easy_reset() in this function,
   though...

 http.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/http.c b/http.c
index ed6414a..b642eac 100644
--- a/http.c
+++ b/http.c
@@ -494,6 +494,7 @@ struct active_request_slot *get_active_slot(void)
 	curl_easy_setopt(slot->curl, CURLOPT_CUSTOMREQUEST, NULL);
 	curl_easy_setopt(slot->curl, CURLOPT_READFUNCTION, NULL);
 	curl_easy_setopt(slot->curl, CURLOPT_WRITEFUNCTION, NULL);
+	curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDS, NULL);
 	curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0);
 	curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1);
 
-- 
1.7.5

Re: [PATCH] http: clear POSTFIELDS when initializing a slot

[Shawn Pearce]

On Tue, Apr 26, 2011 at 08:28, Junio C Hamano <gitster@pobox.com> wrote:
> After posting a short request using CURLOPT_POSTFIELDS, if the slot
> is reused for posting a large payload, the slot ends up having both
> POSTFIELDS (which now points at a random garbage) and READFUNCTION,
> in which case the curl library tries to use the stale POSTFIELDS.
>
> Clear it as part of the general slot initialization in get_active_slot().
>
> Heavylifting-by: Shawn Pearce <spearce@spearce.org>
> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Acked-by: Shawn Pearce <spearce@spearce.org>

FWIW, this bug exists since Git 1.6.6, when smart HTTP was first
introduced. We just get lucky most of the time up until 1.7.4, and
usually never have a failure, as fetch-pack/upload-pack negotiation
packets are almost always smaller than the http.postbuffer size.
Between 1.6.6 and 1.7.4, if it exceeds the postbuffer size, it may not
be possible to fetch because the prior POSTFIELDS will be sent, which
means the client will never transmit "done" and get a pack.

In 1.7.5 smart HTTP push is horribly broken without this patch.

>  * This came up while Shawn was looking at the smart HTTP code again.  It
>   makes me wonder why we do not use curl_easy_reset() in this function,
>   though...

Yea, makes me wonder too. :-)

> diff --git a/http.c b/http.c
> index ed6414a..b642eac 100644
> --- a/http.c
> +++ b/http.c
> @@ -494,6 +494,7 @@ struct active_request_slot *get_active_slot(void)
>        curl_easy_setopt(slot->curl, CURLOPT_CUSTOMREQUEST, NULL);
>        curl_easy_setopt(slot->curl, CURLOPT_READFUNCTION, NULL);
>        curl_easy_setopt(slot->curl, CURLOPT_WRITEFUNCTION, NULL);
> +       curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDS, NULL);
>        curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0);
>        curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1);

-- 
Shawn.