Description
Summary:
A heap-based buffer overflow exists in the AmigaOS-specific DNS resolution
function Curl_ipv4_resolve_r located in lib/amigaos.c.
The function uses gethostbyname_r() with a fixed-size heap buffer
(CURL_HOSTENT_SIZE) and performs incorrect pointer arithmetic when calculating
the data buffer offset and size. This fails to account for structure alignment
and padding requirements, which can result in the resolver writing past the
allocated heap buffer.
The issue is specific to AmigaOS builds using the bsdsocket.library backend.
## Impact
Impact Summary:
An attacker who can influence DNS responses or cause resolution of attacker-
controlled hostnames may trigger heap memory corruption in curl or libcurl
processes on AmigaOS.
Potential impacts include:
- Process crash (denial of service)
- Heap memory corruption
- Possible code execution depending on heap layout and mitigations
The impact is limited to AmigaOS platforms.
A heap-based buffer overflow exists in the AmigaOS-specific DNS resolution
function Curl_ipv4_resolve_r located in lib/amigaos.c.
The function uses gethostbyname_r() with a fixed-size heap buffer
(CURL_HOSTENT_SIZE) and performs incorrect pointer arithmetic when calculating
the data buffer offset and size. This fails to account for structure alignment
and padding requirements, which can result in the resolver writing past the
allocated heap buffer.
The issue is specific to AmigaOS builds using the bsdsocket.library backend.
## Impact
Impact Summary:
An attacker who can influence DNS responses or cause resolution of attacker-
controlled hostnames may trigger heap memory corruption in curl or libcurl
processes on AmigaOS.
Potential impacts include:
- Process crash (denial of service)
- Heap memory corruption
- Possible code execution depending on heap layout and mitigations
The impact is limited to AmigaOS platforms.
Basic Information
ID
H1:3468410
Published
Dec 17, 2025 at 05:44
Modified
Dec 17, 2025 at 13:20