Integer Overflow to Heap Overflow in DoH Response Handling

Summary: An integer overflow vulnerability exists in the `doh_probe_write_cb` function in `lib/doh.c`. This function is used as a write callback for DNS-over-HTTPS (DoH) responses. When a malicious DoH server sends a response with a crafted size, the multiplication of `size` and `nmemb` can …

    #include <stdio.h>
    #include <string.h>
    #include <stdlib.h>

    #define CURL_STATICLIB
    #include <curl/curl.h>

    // --- From curl/lib/curlx/dynbuf.h ---
    struct dynbuf {
      char *bufr;
      size_t leng;
      size_t allc;
      size_t toobig;
    };

    #define …