HACKERONE

curl: Heap buffer overflow in Curl_ipv4_resolve_r due to incorrect buffer alignment and size calculation on AmigaOS_H1:3468410

Description

Summary:

A heap-based buffer overflow exists in the AmigaOS-specific DNS resolution
function Curl_ipv4_resolve_r located in lib/amigaos.c.

The function uses gethostbyname_r() with a fixed-size heap buffer
(CURL_HOSTENT_SIZE) and performs incorrect pointer arithmetic when calculating
the data buffer offset and size. This fails to account for structure alignment
and padding requirements, which can result in the resolver writing past the
allocated heap buffer.

The issue is specific to AmigaOS builds using the bsdsocket.library backend.

## Impact

Impact Summary:

An attacker who can influence DNS responses or cause resolution of attacker-
controlled hostnames may trigger heap memory corruption in curl or libcurl
processes on AmigaOS.

Potential impacts include:
- Process crash (denial of service)
- Heap memory corruption
- Possible code execution depending on heap layout and mitigations

The impact is limited to AmigaOS platforms.
Visit Original Source

Basic Information

ID H1:3468410
Published Dec 17, 2025 at 05:44
Modified Dec 17, 2025 at 13:20

πŸ’­ Join the Security Discussion

πŸ”’ Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.