curl_get_line: fix potential infinite loop when filename is a directory

Fix potential inifinite loop reading file content with `Curl_get_line()`
when a filename passed via these options are pointing to a directory
entry (on non-Windows):

- `--alt-svc` / `CURLOPT_ALTSVC`
- `-b` / `--cookie` / `CURLOPT_COOKIEFILE`
- `--hsts` / `CURLOPT_HSTS`
- `--netrc-file` / `CURLOPT_NETRC_FILE`

Fix by checking for this condition and silently skipping such filename
without attempting to read content. Add test 1713 to verify.

Mention in cookie documentation as an accepted case, also show a verbose
message when a directory is detected. Extend test 46 to verify if such
failure lets the logic continue to the next cookie file.

Reported-and-based-on-patch-by: Richard Tollerton
Fixes #20823
Closes #20826 (originally-based-on)
Follow-up to 769ccb4d42 #19140

Closes #20873
This commit is contained in:
Viktor Szakats 2026-03-10 01:03:13 +01:00
parent 6d87eb2878
commit e76968e20d
No known key found for this signature in database
9 changed files with 116 additions and 61 deletions

View file

@ -229,7 +229,7 @@ test1670 test1671 \
test1680 test1681 test1682 test1683 \
\
test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \
test1708 test1709 test1710 test1711 test1712 \
test1708 test1709 test1710 test1711 test1712 test1713 \
\
test1800 test1801 test1802 test1847 test1848 test1849 test1850 \
\

36
tests/data/test1713 Normal file
View file

@ -0,0 +1,36 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTP GET
Alt-Svc
cookies
HSTS
netrc
</keywords>
</info>
# Client-side
<client>
<name>
Filenames pointing to directory failing gracefully
</name>
<command>
http://invalid.invalid/%TESTNUMBER --alt-svc %LOGDIR --cookie %LOGDIR --hsts %LOGDIR --netrc-file %LOGDIR
</command>
<features>
alt-svc
cookies
HSTS
netrc
</features>
</client>
<verify>
# 26 = CURLE_READ_ERROR
<errorcode>
26
</errorcode>
</verify>
</testcase>

View file

@ -48,7 +48,7 @@ HTTP with bad domain name, get cookies and store in cookie jar
TZ=GMT
</setenv>
<command>
domain..tld:%HTTPPORT/want/%TESTNUMBER --resolve domain..tld:%HTTPPORT:%HOSTIP -c %LOGDIR/jar%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER
domain..tld:%HTTPPORT/want/%TESTNUMBER --resolve domain..tld:%HTTPPORT:%HOSTIP -c %LOGDIR/jar%TESTNUMBER -b %LOGDIR -b %LOGDIR/injar%TESTNUMBER
</command>
<file name="%LOGDIR/injar%TESTNUMBER">
# Netscape HTTP Cookie File