Commit cff89bc0 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

cookie: replace use of fgets() with custom version 

... that will ignore lines that are too long to fit in the buffer.

CVE-2016-8615

Bug: https://curl.haxx.se/docs/adv_20161102A.html
Reported-by: Cure53
parent 811a693b

lib/cookie.c

+30 −1
Original line number Original line Diff line number Diff line
@@ -902,6 +902,35 @@ Curl_cookie_add(struct Curl_easy *data, 
  return co;

  return co;

}

}





/*

 * get_line() makes sure to only return complete whole lines that fit in 'len'

 * bytes and end with a newline.

 */

static char *get_line(char *buf, int len, FILE *input)

{

  bool partial = FALSE;

  while(1) {

    char *b = fgets(buf, len, input);

    if(b) {

      size_t rlen = strlen(b);

      if(rlen && (b[rlen-1] == '\n')) {

        if(partial) {

          partial = FALSE;

          continue;

        }

        return b;

      }

      else

        /* read a partial, discard the next piece that ends with newline */

        partial = TRUE;

    }

    else

      break;

  }

  return NULL;

}





/*****************************************************************************

/*****************************************************************************

 *

 *

 * Curl_cookie_init()

 * Curl_cookie_init()
@@ -958,7 +987,7 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy *data, 
    line = malloc(MAX_COOKIE_LINE);

    line = malloc(MAX_COOKIE_LINE);

    if(!line)

    if(!line)

      goto fail;

      goto fail;

    while(fgets(line, MAX_COOKIE_LINE, fp)) {

    while(get_line(line, MAX_COOKIE_LINE, fp)) {

      if(checkprefix("Set-Cookie:", line)) {

      if(checkprefix("Set-Cookie:", line)) {

        /* This is a cookie line, get it! */

        /* This is a cookie line, get it! */

        lineptr=&line[11];

        lineptr=&line[11];