You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.
/* For Netscape file format cookies we check prefix on the name */
if(strncasecompare("__Secure-", co->name, 9))
According to the first if statement co->name can be null and co->name is passed to strncasecompare (Curl_strncasecompare) which does not check for null and dereferences this parameter.
In case the name pointer isn't set (due to memory pressure most likely)
we need to skip the prefix matching and reject with a badcookie to avoid
a possible NULL pointer dereference.
Closescurl#3820
Reported-by: Jonathan Moerman
I had to look for bugs in curl using Coverity for an assignment and encountered this in cookie.c:
curl/lib/cookie.c
Lines 875 to 878 in b898b4c
According to the first if statement
co->name
can be null andco->name
is passed tostrncasecompare
(Curl_strncasecompare
) which does not check for null and dereferences this parameter.Encountered when analyzing 9e8f28a, still present in b898b4c (which currently is the latest commit in master).
I don't think that it is a huge issue, but it doesn't seem to be a false positive and could potentially cause a crash.
The text was updated successfully, but these errors were encountered: