From b05d7b8d8f8dd0cf717e53324af46f62b27db5ea Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 4 Oct 2016 23:26:13 +0200
Subject: [PATCH] cookies: getlist() now holds deep copies of all cookies

Previously it only held references to them, which was reckless as the
thread lock was released so the cookies could get modified by other
handles that share the same cookie jar over the share interface.
---
 lib/cookie.c | 61 +++++++++++++++++++++++++++++++++++++++---------------------
 lib/cookie.h |  4 ++--
 lib/http.c   |  2 +-
 3 files changed, 43 insertions(+), 24 deletions(-)

Index: curl-7.19.7/lib/cookie.c
===================================================================
--- curl-7.19.7.orig/lib/cookie.c
+++ curl-7.19.7/lib/cookie.c
@@ -847,6 +847,39 @@ struct CookieInfo *Curl_cookie_init(stru
   return c;
 }
 
+#define CLONE(field)                     \
+  do {                                   \
+    if(src->field) {                     \
+      dup->field = strdup(src->field);   \
+      if(!dup->field)                    \
+        goto fail;                       \
+    }                                    \
+  } while(0)
+
+  static struct Cookie *dup_cookie(struct Cookie *src)
+  {
+    struct Cookie *dup = calloc(sizeof(struct Cookie), 1);
+    if(dup) {
+      CLONE(expirestr);
+      CLONE(domain);
+      CLONE(path);
+      CLONE(name);
+      CLONE(value);
+      CLONE(maxage);
+      CLONE(version);
+      dup->expires = src->expires;
+      dup->tailmatch = src->tailmatch;
+      dup->secure = src->secure;
+      dup->livecookie = src->livecookie;
+      dup->httponly = src->httponly;
+    }
+    return dup;
+
+    fail:
+    freecookie(dup);
+    return NULL;
+  }
+
 /*****************************************************************************
  *
  * Curl_cookie_getlist()
@@ -901,10 +934,8 @@ struct Cookie *Curl_cookie_getlist(struc
           /* and now, we know this is a match and we should create an
              entry for the return-linked-list */
 
-          newco = malloc(sizeof(struct Cookie));
+          newco = dup_cookie(co);
           if(newco) {
-            /* first, copy the whole source cookie: */
-            memcpy(newco, co, sizeof(struct Cookie));
 
             /* then modify our next */
             newco->next = mainco;
@@ -914,12 +945,7 @@ struct Cookie *Curl_cookie_getlist(struc
           }
           else {
             /* failure, clear up the allocated chain and return NULL */
-            while(mainco) {
-              co = mainco->next;
-              free(mainco);
-              mainco = co;
-            }
-
+            Curl_cookie_freelist(mainco);
             return NULL;
           }
         }
@@ -941,34 +967,29 @@ struct Cookie *Curl_cookie_getlist(struc
 void Curl_cookie_clearall(struct CookieInfo *cookies)
 {
   if(cookies) {
-    Curl_cookie_freelist(cookies->cookies, TRUE);
+    Curl_cookie_freelist(cookies->cookies);
     cookies->cookies = NULL;
     cookies->numcookies = 0;
   }
 }
 
+
+
 /*****************************************************************************
  *
  * Curl_cookie_freelist()
  *
  * Free a list of cookies previously returned by Curl_cookie_getlist();
  *
- * The 'cookiestoo' argument tells this function whether to just free the
- * list or actually also free all cookies within the list as well.
- *
  ****************************************************************************/
 
-void Curl_cookie_freelist(struct Cookie *co, bool cookiestoo)
+void Curl_cookie_freelist(struct Cookie *co)
 {
   struct Cookie *next;
   if(co) {
     while(co) {
       next = co->next;
-      if(cookiestoo)
-        freecookie(co);
-      else
-        free(co); /* we only free the struct since the "members" are all just
-                     pointed out in the main cookie list! */
+      freecookie(co);
       co = next;
     }
   }
Index: curl-7.19.7/lib/cookie.h
===================================================================
--- curl-7.19.7.orig/lib/cookie.h
+++ curl-7.19.7/lib/cookie.h
@@ -92,7 +92,7 @@ struct CookieInfo *Curl_cookie_init(stru
                                     const char *, struct CookieInfo *, bool);
 struct Cookie *Curl_cookie_getlist(struct CookieInfo *, const char *,
                                    const char *, bool);
-void Curl_cookie_freelist(struct Cookie *cookies, bool cookiestoo);
+void Curl_cookie_freelist(struct Cookie *cookies);
 void Curl_cookie_clearall(struct CookieInfo *cookies);
 void Curl_cookie_clearsess(struct CookieInfo *cookies);
 void Curl_cookie_cleanup(struct CookieInfo *);
Index: curl-7.19.7/lib/http.c
===================================================================
--- curl-7.19.7.orig/lib/http.c
+++ curl-7.19.7/lib/http.c
@@ -2682,7 +2682,7 @@ CURLcode Curl_http(struct connectdata *c
         }
         co = co->next; /* next cookie please */
       }
-      Curl_cookie_freelist(store, FALSE); /* free the cookie list */
+      Curl_cookie_freelist(store);
     }
     if(addcookies && (CURLE_OK == result)) {
       if(!count)
