Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible null dereference in cookie.c #3820

JMoerman opened this issue Apr 30, 2019 · 1 comment

Possible null dereference in cookie.c #3820

JMoerman opened this issue Apr 30, 2019 · 1 comment


Copy link

I had to look for bugs in curl using Coverity for an assignment and encountered this in cookie.c:


Lines 875 to 878 in b898b4c

badcookie = TRUE;
/* For Netscape file format cookies we check prefix on the name */
if(strncasecompare("__Secure-", co->name, 9))

According to the first if statement co->name can be null and co->name is passed to strncasecompare (Curl_strncasecompare) which does not check for null and dereferences this parameter.

int Curl_strncasecompare(const char *first, const char *second, size_t max)
  while(*first && *second && max) {

Encountered when analyzing 9e8f28a, still present in b898b4c (which currently is the latest commit in master).

I don't think that it is a huge issue, but it doesn't seem to be a false positive and could potentially cause a crash.

danielgustafsson added a commit to danielgustafsson/curl that referenced this issue Apr 30, 2019
In case the name pointer isn't set (due to memory pressure most likely)
we need to skip the prefix matching and reject with a badcookie to avoid
a possible NULL pointer dereference.

Closes curl#3820
Reported-by: Jonathan Moerman
Copy link

Thanks for the report, it is indeed a low-risk NULL pointer deref case. I've opened PR #3821 to fix this.

@lock lock bot locked as resolved and limited conversation to collaborators Jul 30, 2019
@bagder bagder added the cookies label Nov 17, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Successfully merging a pull request may close this issue.

3 participants