curl: curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

Summary: CURLSH the curl share handle allows multiple easy handles to share state — cookies, DNS cache, SSL sessions, connection cache — across threads. The share is protected by optional user-supplied mutex callbacks CURLSHOPTLOCKFUNC / CURLSHOPTUNLOCKFUNC. When a caller invokes curlsharesetopts...