Please sign in to comment.
cookie: avoid harmless use after free
This fix removes a use after free which can be triggered by the internal cookie fuzzer, but otherwise is probably impossible to trigger from an ordinary application. The following program reproduces it: curl_global_init(CURL_GLOBAL_DEFAULT); CURL* handle=curl_easy_init(); CookieInfo* info=Curl_cookie_init(handle,NULL,NULL,false); curl_easy_setopt(handle, CURLOPT_COOKIEJAR, "/dev/null"); Curl_flush_cookies(handle, true); Curl_cookie_cleanup(info); curl_easy_cleanup(handle); curl_global_cleanup(); This was found through fuzzing. Closes #4454
- Loading branch information...