GNOME Bugzilla – Bug 604794
malformed cookie header causes endless loop
Last modified: 2009-12-17 12:55:33 UTC
malformed cookie header (ends with comma) causes endless loop when libsoup trying to parse it Steps to Reproduce: 1) Set a server that responds with this header: Set-Cookie: name=value; max-age=20000000, 2) point epiphany(or midori) to this server ACT: Epiphany hungs checked on epiphany 2.28.2-1 (libsoup 2.28.2) libsoup falls in endless loop. That occurs in parse_one_cookie() soup-cookie.c if (*p == ',') { p = skip_lws (p + 1); if (*p) *header_p = p; } else *header_p = NULL; it calls skip_lws() with pointer to EOL, skip_lws() skips nothing and returns pointer to same EOL, so *header_p is remained unchanged, so soup_cookies_from_response() call parse_one_cookie() again and again with same header string checking for EOL should be performed somewhere, this fixed the issue for me: if (*p == ',') { p = skip_lws (p + 1); if (*p) *header_p = p; + else + *header_p = NULL; } else *header_p = NULL;
fixed in master