romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 10:47:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookies: getlist() now holds deep copies of all cookies

Browse source 
Previously it only held references to them, which was reckless as the
thread lock was released so the cookies could get modified by other
handles that share the same cookie jar over the share interface.

CVE-2016-8623

Bug: https://curl.haxx.se/docs/adv_20161102I.html
Reported-by: Cure53
This commit is contained in:
Daniel Stenberg 2016-10-04 23:26:13 +02:00
parent fba28277ca
commit c5be3d7267
3 changed files with 43 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/http.c
View file

@ -2384,7 +2384,7 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
}
co = co->next; /* next cookie please */
}
Curl_cookie_freelist(store, FALSE); /* free the cookie list */
Curl_cookie_freelist(store);
}
if(addcookies && !result) {
if(!count)