{“lastseen”:”2025-11-15T23:25:47″,”description”:”## Summary\\n\\nFound an off-by-one buffer overflow in `lib\/smb.c` when handling SMB file paths. The bounds check uses `\\u003e` instead of `\\u003e=`, allowing a path of exactly 1023 bytes to overflow the 1024-byte buffer by one byte when the null terminator is added.\\n\\n## Details\\n\\n**File:** lib\/smb.c \\n**Function:** smb_send_open() \\n**Lines:** 784, 801\\n\\n### The Bug\\n\\n“`c\\nstruct smb_nt_create {\\n \/\/ … other fields …\\n char bytes[1024]; \/\/ fixed size buffer\\n} PACK;\\n\\nstatic CURLcode smb_send_open(…) {\\n struct smb_nt_create msg;\\n const size_t byte_count = strlen(req-\\u003epath) + 1;\\n \\n if(byte_count \\u003e sizeof(msg.bytes)) \/\/ Wrong: should be \\u003e=\\n return CURLE_FILESIZE_EXCEEDED;\\n \\n \/\/ … setup code …\\n \\n strcpy(msg.bytes, req-\\u003epath); \/\/ Overflow when byte_count == 1024\\n}\\n“`\\n\\n### The Math\\n\\n- Buffer size: 1024 bytes\\n- Check allows: byte_count \\u003c= 1024 (because \\u003e not \\u003e=)\\n- If path is 1023 bytes:\\n – `strlen(req-\\u003epath)` = 1023\\n – `byte_count` = 1024\\n – Check: `1024 \\u003e 1024` = FALSE (passes)\\n – `strcpy()` writes 1024 bytes + null = **1025 bytes**\\n – **Overflow by 1 byte**\\n\\n## Testing\\n\\nBuilt curl with ASan to verify:\\n\\n“`bash\\n.\/configure –with-openssl –enable-smb –enable-debug \\\\\\n CFLAGS=\\”-fsanitize=address\\”\\nmake\\n“`\\n\\nSMB support confirmed:\\n“`\\n$ .\/src\/curl –version | grep smb\\nProtocols: … smb smbs …\\n“`\\n\\nNote: Couldn’t trigger the crash in testing because it requires an actual SMB connection, but the bug is visible in the code.\\n\\n## Fix\\n\\nTwo changes needed:\\n\\n“`diff\\n- if(byte_count \\u003e sizeof(msg.bytes))\\n+ if(byte_count \\u003e= sizeof(msg.bytes))\\n return CURLE_FILESIZE_EXCEEDED;\\n\\n- strcpy(msg.bytes, req-\\u003epath);\\n+ memcpy(msg.bytes, req-\\u003epath, byte_count);\\n“`\\n\\n## Notes\\n\\n- Tested on curl master branch\\n- SMB support must be compiled in\\n- Bug is in release builds, not debug-only\\n- Manual code review, no AI used\\n\\nThis is a real bug that should be fixed, even though exploitation is unlikely.\\n\\n## Impact\\n\\n- Memory corruption (1 byte past buffer)\\n- Likely causes crash\\n- RCE unlikely (off-by-one is hard to exploit)\\n- Affects any app using libcurl with SMB”,”published”:”2025-11-15T19:12:02″,”modified”:”2025-11-15T22:38:07″,”type”:”hackerone”,”title”:”curl: Off-by-One Buffer Overflow in SMB Path Handler”,”source”:””,”references”:””,”id”:”H1:3427343″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3427343″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-15T23:25:47″,”description”:”## Summary\\n\\nFound an off-by-one buffer overflow in `lib\/smb.c` when handling SMB file paths. The bounds check uses `\\u003e` instead of `\\u003e=`, allowing a path of…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-26403","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n