Use after free in hyperfifo example

How it was found

Summary:

THIS ONLY IS AN ISSUE IN EXAMPLE CODE, NOT CURL ITSELF!

In the hyperfifo example the event base is freed before the curl_multi_cleanup is called. This leads to a use after free in the addsocket callback, when libevent tries to lock a mutex in the base event during the curl shutdown.

Link to the problematic code: https://github.com/curl/curl/blob/d6807890696019308bc885871575f3c2dac875d4/docs/examples/hiperfifo.c#L453

Affected version

8.18.0, but the bug has been there for a while, likely since the beginning of that example. Interestingly the multi-event example seems to not be affected.

Steps To Reproduce:

Running the example under ASAN should be sufficient. I have however not verified that, however the same code did cause crashes in my project: https://nheko.im/nheko-reborn/coeurl/-/commit/7e0afef3e774497efa29bf581630747cddd95e55 https://github.com/Nheko-Reborn/nheko/issues/1941

Impact

Summary:

ONLY AFFECTS AN EXAMPLE! NOT A BUG IN CURL!

The impact should basically be none, I am only submitting this here, because I haven't found documentation on how issues in examples should be submitted and other projects might have copied the example as a base (like I did), which can lead to crashes in some circumstances. As such I am just being overly careful in reporting this, please close this as invalid or whatever, if you think that is the best approach. I just wanted to let you judge the impact of this instead of me just reporting something possibly sensitive on the bug tracker.

I don't think an attacker could achieve much more that a crash in projects, that copied the example code.

For example we were affected by this, but haven't filed any security issue about it either: https://github.com/Nheko-Reborn/nheko/issues/1941