Commit 97b66ebe authored by Andrei Cipu's avatar Andrei Cipu Committed by Daniel Stenberg
Browse files

cookies: strip the numerical ipv6 host properly 

The commit e650dbde that stripped off [brackets] from ipv6-only host
headers for the sake of cookie parsing wrongly incremented the host
pointer which would cause a bad free() call later on.
parent d2e5222e

lib/http.c

+5 −1
Original line number Diff line number Diff line
@@ -1851,9 +1851,13 @@ CURLcode Curl_http(struct connectdata *conn, bool *done) 
         the bracket has been closed */

      int startsearch = 0;

      if(*cookiehost == '[') {

        char *closingbracket = strchr(++cookiehost, ']');

        char *closingbracket;

        closingbracket = strchr(cookiehost+1, ']');

        if(closingbracket)

          *closingbracket = 0;

        /* since the 'cookiehost' is an allocated memory area that will be

           freed later we cannot simply increment the pointer */

        memmove(cookiehost, cookiehost + 1, strlen(cookiehost) - 1);

      }

      else {

        char *colon = strchr(cookiehost + startsearch, ':');