cookie-jar: bail if hostname is an empty string (CVE-2018-12910)

https://nvd.nist.gov/vuln/detail/CVE-2018-12910

Change-Id: Icd72ec579aaf2e4d372be33ebb9346a34565d097
Signed-off-by: Cheoleun Moon <chleun.moon@samsung.com>

diff --git a/libsoup/soup-cookie-jar.c b/libsoup/soup-cookie-jar.c
index eac9cd9..fddf2ec 100755 (executable)
--- a/libsoup/soup-cookie-jar.c
+++ b/libsoup/soup-cookie-jar.c
@@ -307,7 +307,7 @@ get_cookies (SoupCookieJar *jar, SoupURI *uri, gboolean for_http, gboolean copy_
 
        priv = SOUP_COOKIE_JAR_GET_PRIVATE (jar);
 
-       if (!uri->host)
+       if (!uri->host || !uri->host[0])
                return NULL;
 
        /* The logic here is a little weird, but the plan is that if