HACKERONE

curl: Off-by-One Buffer Overflow in SMB Path Handler_H1:3427343

Description

## Summary

Found an off-by-one buffer overflow in `lib/smb.c` when handling SMB file paths. The bounds check uses `>` instead of `>=`, allowing a path of exactly 1023 bytes to overflow the 1024-byte buffer by one byte when the null terminator is added.

## Details

**File:** lib/smb.c
**Function:** smb_send_open()
**Lines:** 784, 801

### The Bug

```c
struct smb_nt_create {
// ... other fields ...
char bytes[1024]; // fixed size buffer
} PACK;

static CURLcode smb_send_open(...) {
struct smb_nt_create msg;
const size_t byte_count = strlen(req->path) + 1;

if(byte_count > sizeof(msg.bytes)) // Wrong: should be >=
return CURLE_FILESIZE_EXCEEDED;

// ... setup code ...

strcpy(msg.bytes, req->path); // Overflow when byte_count == 1024
}
```

### The Math

- Buffer size: 1024 bytes
- Check allows: byte_count <= 1024 (because > not >=)
- If path is 1023 bytes:
- `strlen(req->path)` = 1023
- `byte_count` = 1024
- Check: `1024 > 1024` = FALSE (passes)
- `strcpy()` writes 1024 bytes + null = **1025 bytes**
- **Overflow by 1 byte**

## Testing

Built curl with ASan to verify:

```bash
./configure --with-openssl --enable-smb --enable-debug \
CFLAGS="-fsanitize=address"
make
```

SMB support confirmed:
```
$ ./src/curl --version | grep smb
Protocols: ... smb smbs ...
```

Note: Couldn't trigger the crash in testing because it requires an actual SMB connection, but the bug is visible in the code.

## Fix

Two changes needed:

```diff
- if(byte_count > sizeof(msg.bytes))
+ if(byte_count >= sizeof(msg.bytes))
return CURLE_FILESIZE_EXCEEDED;

- strcpy(msg.bytes, req->path);
+ memcpy(msg.bytes, req->path, byte_count);
```

## Notes

- Tested on curl master branch
- SMB support must be compiled in
- Bug is in release builds, not debug-only
- Manual code review, no AI used

This is a real bug that should be fixed, even though exploitation is unlikely.

## Impact

- Memory corruption (1 byte past buffer)
- Likely causes crash
- RCE unlikely (off-by-one is hard to exploit)
- Affects any app using libcurl with SMB
Visit Original Source

Basic Information

ID H1:3427343
Published Nov 15, 2025 at 19:12
Modified Nov 15, 2025 at 22:38

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.