IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser
该报告还没有中文解读。
原文摘录
摘自原文(6602 字符中的一小部分)
On 32-bit builds of libcurl, the IMAP FETCH handler truncates a server-announced literal size (`{size}`) from `curl_off_t` (64-bit) to `size_t` (32-bit) when it decides how many already-buffered bytes belong to the literal body. When a malicious or malfunctioning IMAP server announces a literal …原文中的代码
/* lib/imap.c ~1272-1280 */ size_t chunk = after_header; /* bytes already buffered after the header line */ ... if(chunk > (size_t)size) /* <-- size (curl_off_t) truncated to size_t */ chunk = (size_t)size;
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @cyberfathy · 版权归作者与 curl 所有