[gnurl] 137/222: cookie: avoid harmless use after free

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit 13ecc0725f723ce7068c114610f6d1418945705a
Author: Paul Dreik <address@hidden>
AuthorDate: Thu Oct 3 10:57:09 2019 +0200

    cookie: avoid harmless use after free
    
    This fix removes a use after free which can be triggered by
    the internal cookie fuzzer, but otherwise is probably
    impossible to trigger from an ordinary application.
    
    The following program reproduces it:
    
            curl_global_init(CURL_GLOBAL_DEFAULT);
            CURL*  handle=curl_easy_init();
            CookieInfo* info=Curl_cookie_init(handle,NULL,NULL,false);
            curl_easy_setopt(handle, CURLOPT_COOKIEJAR, "/dev/null");
            Curl_flush_cookies(handle, true);
            Curl_cookie_cleanup(info);
            curl_easy_cleanup(handle);
            curl_global_cleanup();
    
    This was found through fuzzing.
    
    Closes #4454
---
 lib/cookie.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/cookie.c b/lib/cookie.c
index f6b52df2f..c6c4a7bdd 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -1646,6 +1646,7 @@ void Curl_flush_cookies(struct Curl_easy *data, int 
cleanup)
 
   if(cleanup && (!data->share || (data->cookies != data->share->cookies))) {
     Curl_cookie_cleanup(data->cookies);
+    data->cookies = NULL;
   }
   Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
 }

-- 
To stop receiving notification emails like this one, please contact
address@hidden.