NULL Pointer Dereference (DoS) in libcurl SFTP QUOTE command parsing due to missing return statement

How it was found

Summary:

A logic flaw in lib/vssh/libssh2.c causes a NULL pointer dereference when parsing SFTP QUOTE commands with trailing garbage. The function return_quote_error is called to handle errors and free memory, but the return keyword is missing in several blocks (e.g., lines 840, 857, 870). This allows the state machine to continue execution using NULL pointers, leading to an immediate segmentation fault. This is a reliable Remote Denial of Service (DoS) vector.

Affected version

[curl 8.18.0 (x86_64-pc-linux-gnu) libcurl/8.18.0 OpenSSL/3.5.4 zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 libidn2/2.3.8]

Steps To Reproduce:

[Ensure a local SFTP server is running. Execute the following command with trailing garbage in the QUOTE command: curl -k -u user:pass sftp://127.0.0.1/ -Q "mkdir /tmp/test trailing_garbage" Observe the immediate crash: Segmentation fault (core dumped).]

Impact

Summary:

This vulnerability allows for a reliable Remote Denial of Service (DoS). Any application, service, or automated script utilizing libcurl to process SFTP QUOTE commands (especially those accepting user-supplied input) can be crashed instantly. This leads to service unavailability and can be used to disrupt critical infrastructure relying on curl for file transfers.