From 1c73f83a428824490efd1c1ea2a4ba69a9a8d982 Mon Sep 17 00:00:00 2001
From: Acts1631 <acts1631kjv@proton.me>
Date: Tue, 25 Aug 2026 15:30:04 -0400
Subject: [PATCH] upnp: defer cleanup for HTTP status errors

Deleting the device description downloader from OnHeaders() frees the
CurlResponseHandlerAdapter while DataReceived() still uses it. A UPnP
server can trigger a use-after-free by returning a non-200 response with
body data.

Throw HttpStatusError so the adapter defers cleanup until OnError().
---
 src/lib/upnp/Discovery.cxx | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/lib/upnp/Discovery.cxx b/src/lib/upnp/Discovery.cxx
index 8caf936755..8edc46e16b 100644
--- a/src/lib/upnp/Discovery.cxx
+++ b/src/lib/upnp/Discovery.cxx
@@ -8,6 +8,7 @@
 #include "Error.hxx"
 #include "lib/curl/Global.hxx"
 #include "lib/curl/Handler.hxx"
+#include "lib/curl/HttpStatusError.hxx"
 #include "lib/curl/Request.hxx"
 #include "event/Call.hxx"
 #include "event/InjectEvent.hxx"
@@ -104,10 +105,9 @@ void
 UPnPDeviceDirectory::Downloader::OnHeaders(unsigned status,
 					   Curl::Headers &&)
 {
-	if (status != 200) {
-		Destroy();
-		return;
-	}
+	if (status != 200)
+		throw HttpStatusError(status,
+				      "Failed to download UPnP device description");
 }
 
 void