POJIA破甲
地图 / 57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`

57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`

内存破坏 / 越界读 / #3973219

厂商
curl
严重程度
未评级
赏金
—
弱点
越界读
研究员
@giant_anteater
披露日期
2026-09-07
资产
https://github.com/curl/curl
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(6091 字符中的一小部分)
`curl_easy_escape_ccsid()` and `curl_easy_unescape_ccsid()` in `projects/OS400/ccsidcurl.c` discard the converted byte count returned by `dynconvert()` and pass `0` to the downstream `curl_easy_escape()` / `curl_easy_unescape()`. When the caller supplies a positive explicit `length` with …
原文中的代码
// curl_easy_escape_ccsid — line 283
s = dynconvert(ASCII_CCSID, string, length ? length : -1, sccsid, NULL);
// ...
d = curl_easy_escape(handle, s, 0);   // line 288 — 0 means strlen()

// curl_easy_unescape_ccsid — line 312
s = dynconvert(ASCII_CCSID, string, length ? length : -1, sccsid, NULL); …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @giant_anteater · 版权归作者与 curl 所有

同类报告

OOB reads in network message handlers leads to RCEValve · 2021-05-04 · $7,500RCE on CS:GO client using unsanitized entity ID in EntityMsg messageValve · 2021-05-27 · $9,000CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP downloadValve · 2021-05-17 · $7,500Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijackingMariaDB · 2026-09-08Firecracker Out-of-bounds Read/Write Local Privilege Escalation VulnerabilityAWS VDP · 2026-06-11Conflux-queued zero-length RELAY_END triggers heap out-of-bounds readTor · 2026-09-10