David Cohen pointed out that RFC2109 says clients should allow cookies to

contain least 4096 bytes while libcurl only allowed 2047. I raised the limit
to 4999 now and made the used buffer get malloc()ed instead of simply
allocated on stack as before.

lib/cookie.c

@@ -149,7 +149,7 @@ Curl_cookie_add(struct SessionHandle *data,
                                     unless set */
 {
   struct Cookie *clist;
-  char what[MAX_COOKIE_LINE];
+  char *what;
   char name[MAX_NAME];
   char *ptr;
   char *semiptr;
@@ -167,6 +167,13 @@ Curl_cookie_add(struct SessionHandle *data,
   if(httpheader) {
     /* This line was read off a HTTP-header */
     char *sep;
+
+    what = malloc(MAX_COOKIE_LINE);
+    if(!what) {
+      free(co);
+      return NULL;
+    }
+
     semiptr=strchr(lineptr, ';'); /* first, find a semicolon */
 
     while(*lineptr && isspace((int)*lineptr))
@@ -387,6 +394,8 @@ Curl_cookie_add(struct SessionHandle *data,
       }
     }
 
+    free(what);
+
     if(badcookie || !co->name) {
       /* we didn't get a cookie name or a bad one,
          this is an illegal line, bail out */