- Ben Van Hof filed bug report #1945240: "libcurl sometimes sends body twice

when using CURL_AUTH_ANY" (http://curl.haxx.se/bug/view.cgi?id=1945240).
  The problem was that when libcurl rewound a stream meant for upload when it
  would prepare for a second request, it could accidentally continue the
  sending of the rewound data on the first request instead of on the second.
  Ben also provided test case 1030 that verifies this fix.

lib/transfer.c

@@ -228,9 +228,9 @@ checkhttpprefix(struct SessionHandle *data,
 }
 
 /*
- * Curl_readrewind() rewinds the read stream. This typically (so far) only
- * used for HTTP POST/PUT with multi-pass authentication when a sending was
- * denied and a resend is necessary.
+ * Curl_readrewind() rewinds the read stream. This is typically used for HTTP
+ * POST/PUT with multi-pass authentication when a sending was denied and a
+ * resend is necessary.
  */
 CURLcode Curl_readrewind(struct connectdata *conn)
 {
@@ -238,6 +238,11 @@ CURLcode Curl_readrewind(struct connectdata *conn)
 
   conn->bits.rewindaftersend = FALSE; /* we rewind now */
 
+  /* explicitly switch of sending data on this transfer now since we are about
+     to restart a new transfer and thus we want to avoid inadvertently sending
+     more data on the existing connection until the next request starts */
+  data->req.keepon &= ~KEEP_WRITE;
+
   /* We have sent away data. If not using CURLOPT_POSTFIELDS or
      CURLOPT_HTTPPOST, call app to rewind
   */