Integer overflow in the source code tool_cb_prg.c
C
curl
Submitted None
Actions:
Reported by
sfpskywood
Vulnerability Details
Technical details and impact analysis
## Summary:
Integer overflow in the source code tool_cb_prg.c
## Steps To Reproduce:
Review the source code of tool_cb_prg.c
In the function fly, pay attention to Line 80, 82, 84
```C
69 static void fly(struct ProgressData *bar, bool moved)
70 {
71 char buf[256];
72 int pos;
73 int check = bar->width - 2;
74
75 msnprintf(buf, sizeof(buf), "%*s\r", bar->width-1, " ");
76 memcpy(&buf[bar->bar], "-=O=-", 5);
77
78 pos = sinus[bar->tick%200] / (10000 / check);
79 buf[pos] = '#';
80 pos = sinus[(bar->tick + 5)%200] / (10000 / check);
81 buf[pos] = '#';
82 pos = sinus[(bar->tick + 10)%200] / (10000 / check);
83 buf[pos] = '#';
84 pos = sinus[(bar->tick + 15)%200] / (10000 / check);
85 buf[pos] = '#';
```
in Line 80, Line 82, Line 84, there are integer overflow issues.
the type of 'tick' is 'unsigned int'
bar->tick could be a large value, then bar->tick + 5 may revert to a small value.
Here no big impact and only logic error.
I think maybe a logic like this is better to avoid integer overflow.
`pos = sinus[((bar->tick)%200 + 5)%200] / (10000 / check);`
I am not sure if I directly create this issue on github is the correct way, so I report it here.
## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
* [attachment / reference]
The output of the my self-development code scan tool:
[Scanning] /home/a/Data/curl/src/tool_cb_prg.c
Integer Overflow found in file: /home/a/Data/curl/src/tool_cb_prg.c, Line: 80, Column: 28
pos = sinus[(bar->tick + 5)%200] / (10000 / check);
Integer Overflow found in file: /home/a/Data/curl/src/tool_cb_prg.c, Line: 82, Column: 28
pos = sinus[(bar->tick + 10)%200] / (10000 / check);
Integer Overflow found in file: /home/a/Data/curl/src/tool_cb_prg.c, Line: 84, Column: 28
pos = sinus[(bar->tick + 15)%200] / (10000 / check);
## Impact
This integer overflow has no big impact and only may cause business logic error.
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Integer Overflow