formpost: trying to attach a directory no longer crashes

The error path would previously add a freed entry to the linked list. Reported-by: Toby Peterson Fixes curl#1053
dongc · Oct 4, 2016 · bdf162a · bdf162a
1 parent 54e48b1
commit bdf162a
Showing 1 changed file with 8 additions and 7 deletions.
diff --git a/lib/formdata.c b/lib/formdata.c
@@ -863,13 +863,6 @@ static CURLcode AddFormData(struct FormData **formp,
 
   newform->type = type;
 
-  if(*formp) {
-    (*formp)->next = newform;
-    *formp = newform;
-  }
-  else
-    *formp = newform;
-
   if(size) {
     if(type != FORM_FILE)
       /* for static content as well as callback data we add the size given
@@ -889,6 +882,14 @@ static CURLcode AddFormData(struct FormData **formp,
       }
     }
   }
+
+  if(*formp) {
+    (*formp)->next = newform;
+    *formp = newform;
+  }
+  else
+    *formp = newform;
+
   return CURLE_OK;
   error:
   if(newform)