Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Possible null dereference in cookie.c #3820

Closed
JMoerman opened this issue Apr 30, 2019 · 1 comment
Closed

Possible null dereference in cookie.c #3820

JMoerman opened this issue Apr 30, 2019 · 1 comment
Labels
cookies

Comments

@JMoerman
Copy link

I had to look for bugs in curl using Coverity for an assignment and encountered this in cookie.c:

curl/lib/cookie.c

Lines 875 to 878 in b898b4c

if(!co->name)
badcookie = TRUE;
/* For Netscape file format cookies we check prefix on the name */
if(strncasecompare("__Secure-", co->name, 9))

According to the first if statement co->name can be null and co->name is passed to strncasecompare (Curl_strncasecompare) which does not check for null and dereferences this parameter.

int Curl_strncasecompare(const char *first, const char *second, size_t max)
{
  while(*first && *second && max) {
...

Encountered when analyzing 9e8f28a, still present in b898b4c (which currently is the latest commit in master).

I don't think that it is a huge issue, but it doesn't seem to be a false positive and could potentially cause a crash.
danielgustafsson added a commit to danielgustafsson/curl that referenced this issue Apr 30, 2019
@danielgustafsson
cookie: Guard against possible NULL ptr deref
d4bd867 
In case the name pointer isn't set (due to memory pressure most likely)
we need to skip the prefix matching and reject with a badcookie to avoid
a possible NULL pointer dereference.

Closes curl#3820
Reported-by: Jonathan Moerman
@danielgustafsson danielgustafsson mentioned this issue Apr 30, 2019
Closed
@danielgustafsson
Copy link
Member

Thanks for the report, it is indeed a low-risk NULL pointer deref case. I've opened PR #3821 to fix this.

@lock lock bot locked as resolved and limited conversation to collaborators Jul 30, 2019
@bagder bagder added the cookies label Nov 17, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
cookies
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

cookie: Guard against possible NULL ptr deref danielgustafsson/curl
3 participants
@bagder @danielgustafsson @JMoerman