CVE-2022-43552: HTTP Proxy deny use-after-free

How it was found

Issue(s) reported by Trail of Bits. This is either one or two issues.

Summary:

./src/curl 0 -x0:80 telnet:/[j-u][j-u]//0 -m 01 ./src/curl 0 -x0:80 smb:/[j-u][j-u]//0 -m 01

Both command line ends up having libcurl access and use already freed heap-memory. For read and write.

Steps To Reproduce:

See above, run with valgrind for full report.

I have a local HTTP server on localhost host port 80 that will send back a 502 on the CONNECT requests curl issues to it for these protocols.

Supporting Material/References:

See logs.

Impact

Use after free stuff.