Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible null dereference in cookie.c #3820

Closed
JMoerman opened this issue Apr 30, 2019 · 1 comment

Comments

Projects
None yet
2 participants
@JMoerman
Copy link

commented Apr 30, 2019

I had to look for bugs in curl using Coverity for an assignment and encountered this in cookie.c:

curl/lib/cookie.c

Lines 875 to 878 in b898b4c

if(!co->name)
badcookie = TRUE;
/* For Netscape file format cookies we check prefix on the name */
if(strncasecompare("__Secure-", co->name, 9))

According to the first if statement co->name can be null and co->name is passed to strncasecompare (Curl_strncasecompare) which does not check for null and dereferences this parameter.

int Curl_strncasecompare(const char *first, const char *second, size_t max)
{
  while(*first && *second && max) {
...

Encountered when analyzing 9e8f28a, still present in b898b4c (which currently is the latest commit in master).

I don't think that it is a huge issue, but it doesn't seem to be a false positive and could potentially cause a crash.

danielgustafsson added a commit to danielgustafsson/curl that referenced this issue Apr 30, 2019

cookie: Guard against possible NULL ptr deref
In case the name pointer isn't set (due to memory pressure most likely)
we need to skip the prefix matching and reject with a badcookie to avoid
a possible NULL pointer dereference.

Closes curl#3820
Reported-by: Jonathan Moerman
@danielgustafsson

This comment has been minimized.

Copy link
Member

commented Apr 30, 2019

Thanks for the report, it is indeed a low-risk NULL pointer deref case. I've opened PR #3821 to fix this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.