- John P. McCaskey posted a bug report that showed how libcurl did wrong when

  saving received cookies with no given path, if the path in the request had a
  query part. That is means a question mark (?) and characters on the right
  side of that. I wrote test case 1105 and fixed this problem.

1 files changed, 32 insertions, 4 deletions

diff --git a/lib/cookie.c b/lib/cookie.c
index b79d1b07b..13941857c 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -167,6 +167,24 @@ static void strstore(char **str, const char *newstr)
   *str = strdup(newstr);
 }
 
+
+/*
+ * The memrchr() function is like the memchr() function, except that it
+ * searches backwards from the end of the n bytes pointed to by s instead of
+ * forwards from the front.
+ *
+ * Exists in glibc but is not widely available on other systems.
+ */
+static void *memrchr(const char *s, int c, size_t n)
+{
+  while(n--) {
+    if(s[n] == c)
+      return &s[n];
+  }
+  return NULL;
+}
+
+
 /****************************************************************************
  *
  * Curl_cookie_add()
@@ -186,8 +204,8 @@ Curl_cookie_add(struct SessionHandle *data,
                 char *lineptr,   /* first character of the line */
                 const char *domain, /* default domain */
                 const char *path)   /* full path used when this cookie is set,
-                                    used to get default path for the cookie
-                                    unless set */
+                                       used to get default path for the cookie
+                                       unless set */
 {
   struct Cookie *clist;
   char name[MAX_NAME];
@@ -429,8 +447,18 @@ Curl_cookie_add(struct SessionHandle *data,
     }
 
     if(!badcookie && !co->path && path) {
-      /* no path was given in the header line, set the default  */
-      char *endslash = strrchr(path, '/');
+      /* No path was given in the header line, set the default.
+         Note that the passed-in path to this function MAY have a '?' and
+         following part that MUST not be stored as part of the path. */
+      char *queryp = strchr(path, '?');
+
+      /* queryp is where the interesting part of the path ends, so now we
+         want to the find the last */
+      char *endslash;
+      if(!queryp)
+        endslash = strrchr(path, '/');
+      else
+        endslash = memrchr(path, '/', queryp - path);
       if(endslash) {
         size_t pathlen = endslash-path+1; /* include the ending slash */
         co->path=malloc(pathlen+1); /* one extra for the zero byte */