Open_Ultra_SAST/benchmarks/pairs/vfc/curl-cve-2026-9080/fixed.c

/* Provenance: curl/curl mev_forget_socket (fixed).
 * repo: curl/curl
 * commit: e9a2b0dc72dd3a9aa3a5210e89079a3b719475dc
 * parent: f746780a1e548b4b93790b58d70c3b22fde5360d
 * commit_url: https://github.com/curl/curl/commit/e9a2b0dc72dd3a9aa3a5210e89079a3b719475dc
 * cve: CVE-2026-9080
 * license: curl
 * function: mev_forget_socket
 * relpath: lib/multi_ev.c
 * provenance: human
 * mechanism: other
 */

static CURLMcode mev_forget_socket(struct Curl_multi *multi,
                                   struct Curl_easy *data,
                                   curl_socket_t s,
                                   const char *cause)
{
  struct mev_sh_entry *entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
  int rc = 0;

  if(!entry) /* we never knew or already forgot about this socket */
    return CURLM_OK;

  /* We managed this socket before, tell the socket callback to forget it. */
  if(entry->announced && multi->socket_cb) {
    NOVERBOSE((void)cause);
    CURL_TRC_M(data, "ev %s, call(fd=%" FMT_SOCKET_T ", ev=REMOVE)", cause, s);
    mev_in_callback(multi, TRUE);
    rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
                          multi->socket_userp, entry->user_data);
    mev_in_callback(multi, FALSE);
    /* curl_easy_pause() is documented as callable from any callback; it
     * re-enters mev_assess() which may free this 'entry'. Re-fetch. */
    entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
    if(entry)
      entry->announced = FALSE;
  }

  mev_sh_entry_kill(multi, s);
  if(rc == -1) {
    multi->dead = TRUE;
    return CURLM_ABORTED_BY_CALLBACK;
  }
  return CURLM_OK;
}