Fossil

Differences From Artifact [cf67a58e94]:

• File src/cgi.c — part of check-in [070e63db33] at 2008-08-17 20:53:20 on branch trunk — Merge old tagview branch into this branch (user: eric size: 39581) [more...]

To Artifact [48957219a2]:

• File src/cgi.c — part of check-in [aeeba751c4] at 2008-09-11 17:12:11 on branch trunk — Fix a memory double-free'd problem. In function <tt>cgi_set_cookie</tt> the <tt>zDate</tt> was allocated via usage of <tt>cgi_rfc822_datestamp</tt>. But as it was appended to the blob <tt>extraHeader</tt> via the format specifier <tt>%z</tt> the memory was free'd by <tt>blob_appendf</tt>. As <tt>cgi_rfc822_datestamp</tt> might return both a dynamic allocated empty string as well as a dynamic allocated string containing the time stamp, <tt>blob_appendf</tt> should not try to free the <tt>zDate</tt>. So now the format specifier is changed to <tt>%s</tt> to let us decide, if we want to free the memory or not. (user: cle size: 39581)

200
201
202
203
204
205
206
207
208
209
210
211
212
213
214

  int lifetime          /* Expiration of the cookie in seconds from now */
){
  if( zPath==0 ) zPath = g.zTop;
  if( lifetime>0 ){
    lifetime += (int)time(0);
    char * zDate = cgi_rfc822_datestamp(lifetime);
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; expires=%z; Version=1\r\n",
        zName, zValue, zPath, zDate);
    if( zDate[0] ) free( zDate );
  }else{
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; Version=1\r\n",
       zName, zValue, zPath);
  }

|

200
201
202
203
204
205
206
207
208
209
210
211
212
213
214

  int lifetime          /* Expiration of the cookie in seconds from now */
){
  if( zPath==0 ) zPath = g.zTop;
  if( lifetime>0 ){
    lifetime += (int)time(0);
    char * zDate = cgi_rfc822_datestamp(lifetime);
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; expires=%s; Version=1\r\n",
        zName, zValue, zPath, zDate);
    if( zDate[0] ) free( zDate );
  }else{
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; Version=1\r\n",
       zName, zValue, zPath);
  }