From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 11 Aug 2025 20:23:05 +0200 Subject: [PATCH] cookie: don't treat the leading slash as trailing If there is only a leading slash in the path, keep that. Also add an assert to make sure the path is never blank. Reported-by: Google Big Sleep Closes #18266 CVE: CVE-2025-9086 Upstream-Status: Backport [https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6] Signed-off-by: Yogita Urade --- lib/cookie.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/lib/cookie.c b/lib/cookie.c index c1ed291..67494d2 100644 --- a/lib/cookie.c +++ b/lib/cookie.c @@ -316,7 +316,7 @@ static char *sanitize_cookie_path(const char *cookie_path) } /* convert /hoge/ to /hoge */ - if(len && new_path[len - 1] == '/') { + if(len > 1 && new_path[len - 1] == '/') { new_path[len - 1] = 0x0; } @@ -1074,7 +1074,7 @@ Curl_cookie_add(struct Curl_easy *data, clist->spath && co->spath && /* both have paths */ clist->secure && !co->secure && !secure) { size_t cllen; - const char *sep; + const char *sep = NULL; /* * A non-secure cookie may not overlay an existing secure cookie. @@ -1083,8 +1083,9 @@ Curl_cookie_add(struct Curl_easy *data, * "/loginhelper" is ok. */ - sep = strchr(clist->spath + 1, '/'); - + DEBUGASSERT(clist->spath[0]); + if(clist->spath[0]) + sep = strchr(clist->spath + 1, '/'); if(sep) cllen = sep - clist->spath; else -- 2.40.0