Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cookie: avoid harmless use after free #4454

Closed
wants to merge 2 commits into from

Conversation

@pauldreik
Copy link
Contributor

commented Oct 3, 2019

This fix removes a use after free which can be triggered by
the internal cookie fuzzer, but otherwise is probably
impossible to trigger from an ordinary application (Thanks @bagder for checking).

The following program reproduces it:

        curl_global_init(CURL_GLOBAL_DEFAULT);
        CURL*  handle=curl_easy_init();
        CookieInfo* info=Curl_cookie_init(handle,NULL,NULL,false);
        curl_easy_setopt(handle, CURLOPT_COOKIEJAR, "/dev/null");
        Curl_flush_cookies(handle, true);
        Curl_cookie_cleanup(info);
        curl_easy_cleanup(handle);
        curl_global_cleanup();

This was found through fuzzing.

This fix removes a use after free which can be triggered by
the internal cookie fuzzer, but otherwise is probably
impossible to trigger from an ordinary application.

The following program reproduces it:

        curl_global_init(CURL_GLOBAL_DEFAULT);
        CURL*  handle=curl_easy_init();
        CookieInfo* info=Curl_cookie_init(handle,NULL,NULL,false);
        curl_easy_setopt(handle, CURLOPT_COOKIEJAR, "/dev/null");
        Curl_flush_cookies(handle, true);
        Curl_cookie_cleanup(info);
        curl_easy_cleanup(handle);
        curl_global_cleanup();

This was found through fuzzing.
@bagder
bagder approved these changes Oct 3, 2019
@bagder

This comment has been minimized.

Copy link
Member

commented Oct 3, 2019

Picky checksrc:

./cookie.c:1649:19: warning: no space after equals sign (EQUALSNOSPACE)
     data->cookies=NULL;
                   ^
when will I ever learn
@bagder

This comment has been minimized.

Copy link
Member

commented Oct 3, 2019

Thanks!

@bagder bagder closed this in 13ecc07 Oct 3, 2019
@pauldreik pauldreik deleted the pauldreik:paul/cookie-use-after-free branch Oct 4, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.