Memory leak from doh_write_cb
None
C
curl
Submitted None
Actions:
Reported by
catenacyber
Vulnerability Details
Technical details and impact analysis
## Summary:
[summary of the vulnerability]
A memory leak found by curl_fuzzer_http
## Affected version
[Which curl/libcurl version are you using to reproduce? On which platform? `curl -V` typically generates good output to include]
curl 8.13.0-DEV (x86_64-apple-darwin23.6.0) libcurl/8.13.0-DEV OpenSSL/1.0.2n zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 nghttp2/1.55.1 librtmp/2.3
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS HSTS HTTP2 HTTPS-proxy IDN IPv6 Largefile libz NTLM PSL SSL threadsafe TLS-SRP UnixSockets
## Steps To Reproduce:
[add details for how we can reproduce the issue]
1. Run the fuzzer with reproducer
## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
Stack trace is
```
==14==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 107 byte(s) in 1 object(s) allocated from:
#0 0x55da4969379c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x55da496ff27b in curl_dbg_realloc /src/curl/lib/memdebug.c:265:9
#2 0x55da497fc6f3 in dyn_nappend /src/curl/lib/dynbuf.c:111:15
#3 0x55da497faee5 in doh_write_cb /src/curl/lib/doh.c:183:6
#4 0x55da497f2636 in cw_out_ptr_flush /src/curl/lib/cw-out.c:224:16
#5 0x55da497f1644 in cw_out_do_write /src/curl/lib/cw-out.c:383:14
#6 0x55da497f0ab6 in cw_out_write /src/curl/lib/cw-out.c:416:14
#7 0x55da497f2f62 in cw_pause_write /src/curl/lib/cw-pause.c:192:14
#8 0x55da497476e1 in Curl_cwriter_write /src/curl/lib/sendf.c:184:10
#9 0x55da497476e1 in cw_download_write /src/curl/lib/sendf.c:312:14
#10 0x55da497415b9 in Curl_cwriter_write /src/curl/lib/sendf.c:184:10
#11 0x55da497415b9 in Curl_client_write /src/curl/lib/sendf.c:92:12
#12 0x55da498363a5 in Curl_http_write_resp /src/curl/lib/http.c:4201:14
#13 0x55da49762635 in Curl_xfer_write_resp /src/curl/lib/transfer.c:862:14
#14 0x55da4975e364 in sendrecv_dl /src/curl/lib/transfer.c:342:14
#15 0x55da4975e364 in Curl_sendrecv /src/curl/lib/transfer.c:441:14
#16 0x55da497250f5 in state_performing /src/curl/lib/multi.c:1733:12
#17 0x55da497250f5 in multi_runsingle /src/curl/lib/multi.c:2423:12
#18 0x55da497222f2 in curl_multi_perform /src/curl/lib/multi.c:2599:16
#19 0x55da496d3e98 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:419:5
#20 0x55da496d2e47 in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:97:3
```
You need to pass `-runs=100` like `/out/curl_fuzzer_http /out/leak-247f5201c537eecc44d9f44dd815fd43f19a8a72 -runs=100` as it does not happen on every case
## Impact
## Summary:
I guess memory leaks may ultimately lead to DOS...
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Allocation of Resources Without Limits or Throttling