Loading HuntDB...

Memory leak from doh_write_cb

None
C
curl
Submitted None
Reported by catenacyber

Vulnerability Details

Technical details and impact analysis

Allocation of Resources Without Limits or Throttling
## Summary: [summary of the vulnerability] A memory leak found by curl_fuzzer_http ## Affected version [Which curl/libcurl version are you using to reproduce? On which platform? `curl -V` typically generates good output to include] curl 8.13.0-DEV (x86_64-apple-darwin23.6.0) libcurl/8.13.0-DEV OpenSSL/1.0.2n zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 nghttp2/1.55.1 librtmp/2.3 Release-Date: [unreleased] Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp ws wss Features: alt-svc AsynchDNS HSTS HTTP2 HTTPS-proxy IDN IPv6 Largefile libz NTLM PSL SSL threadsafe TLS-SRP UnixSockets ## Steps To Reproduce: [add details for how we can reproduce the issue] 1. Run the fuzzer with reproducer ## Supporting Material/References: [list any additional material (e.g. screenshots, logs, etc.)] Stack trace is ``` ==14==ERROR: LeakSanitizer: detected memory leaks Direct leak of 107 byte(s) in 1 object(s) allocated from: #0 0x55da4969379c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3 #1 0x55da496ff27b in curl_dbg_realloc /src/curl/lib/memdebug.c:265:9 #2 0x55da497fc6f3 in dyn_nappend /src/curl/lib/dynbuf.c:111:15 #3 0x55da497faee5 in doh_write_cb /src/curl/lib/doh.c:183:6 #4 0x55da497f2636 in cw_out_ptr_flush /src/curl/lib/cw-out.c:224:16 #5 0x55da497f1644 in cw_out_do_write /src/curl/lib/cw-out.c:383:14 #6 0x55da497f0ab6 in cw_out_write /src/curl/lib/cw-out.c:416:14 #7 0x55da497f2f62 in cw_pause_write /src/curl/lib/cw-pause.c:192:14 #8 0x55da497476e1 in Curl_cwriter_write /src/curl/lib/sendf.c:184:10 #9 0x55da497476e1 in cw_download_write /src/curl/lib/sendf.c:312:14 #10 0x55da497415b9 in Curl_cwriter_write /src/curl/lib/sendf.c:184:10 #11 0x55da497415b9 in Curl_client_write /src/curl/lib/sendf.c:92:12 #12 0x55da498363a5 in Curl_http_write_resp /src/curl/lib/http.c:4201:14 #13 0x55da49762635 in Curl_xfer_write_resp /src/curl/lib/transfer.c:862:14 #14 0x55da4975e364 in sendrecv_dl /src/curl/lib/transfer.c:342:14 #15 0x55da4975e364 in Curl_sendrecv /src/curl/lib/transfer.c:441:14 #16 0x55da497250f5 in state_performing /src/curl/lib/multi.c:1733:12 #17 0x55da497250f5 in multi_runsingle /src/curl/lib/multi.c:2423:12 #18 0x55da497222f2 in curl_multi_perform /src/curl/lib/multi.c:2599:16 #19 0x55da496d3e98 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:419:5 #20 0x55da496d2e47 in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:97:3 ``` You need to pass `-runs=100` like `/out/curl_fuzzer_http /out/leak-247f5201c537eecc44d9f44dd815fd43f19a8a72 -runs=100` as it does not happen on every case ## Impact ## Summary: I guess memory leaks may ultimately lead to DOS...

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Allocation of Resources Without Limits or Throttling