已合并
8924 漏洞合入6.0分支 #436
8924 漏洞合入6.0分支 #436
已合并
共 1 个文件变更+9-2
| @@ -1033,12 +1033,19 @@ Curl_cookie_add(struct Curl_easy *data, | |||
| 1033 | char lcookie[256]; | 1033 | char lcookie[256]; |
| 1034 | size_t dlen = strlen(domain); | 1034 | size_t dlen = strlen(domain); |
| 1035 | size_t clen = strlen(co->domain); | 1035 | size_t clen = strlen(co->domain); |
| 1036 | + /* trim trailing dots */ | ||
| 1037 | + if(dlen && (domain[dlen - 1] == '.')) | ||
| 1038 | + dlen--; | ||
| 1039 | + if(clen && (co->domain[clen - 1] == '.')) | ||
| 1040 | + clen--; | ||
| 1036 | if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) { | 1041 | if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) { |
| 1037 | const psl_ctx_t *psl = Curl_psl_use(data); | 1042 | const psl_ctx_t *psl = Curl_psl_use(data); |
| 1038 | if(psl) { | 1043 | if(psl) { |
| 1039 | /* the PSL check requires lowercase domain name and pattern */ | 1044 | /* the PSL check requires lowercase domain name and pattern */ |
| 1040 | - Curl_strntolower(lcase, domain, dlen + 1); | 1045 | + Curl_strntolower(lcase, domain, dlen); |
| 1041 | - Curl_strntolower(lcookie, co->domain, clen + 1); | 1046 | + lcase[dlen] = 0; |
| 1047 | + Curl_strntolower(lcookie, co->domain, clen); | ||
| 1048 | + lcookie[clen] = 0; | ||
| 1042 | acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie); | 1049 | acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie); |
| 1043 | Curl_psl_release(data); | 1050 | Curl_psl_release(data); |
| 1044 | } | 1051 | } |