Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Segfault in encodeDN #13684

Trzik opened this issue May 17, 2024 · 0 comments

Segfault in encodeDN #13684

Trzik opened this issue May 17, 2024 · 0 comments


Copy link

Trzik commented May 17, 2024

I did this

The issue happens when curl tries to parse this structure, specifically the OID 1.2.840.113549.1.9.2 - unstructuredName

The segfault (nullptr dereference) happens on this line:

for(p3 = str; ISUPPER(*p3); p3++)

The issue comes from OID2str when searchOID is invoked. OIDtable is searched, entry 1.2.840.113549.1.9.2 is not found and the function returns NULL. However, the result stays CURLE_OK so the calling code assumes the dynbuf is perfectly valid when it is in fact still in unallocated state.

For the record, the issue started occurring with commit 623c3a8 since version 8.6.0.

I'm also attaching a patch that may be helpful.

I expected the following

Not a crash

curl/libcurl version

curl 8.6.0

operating system

Windows 10 (x64, 22631)

@bagder bagder self-assigned this May 17, 2024
bagder added a commit that referenced this issue May 17, 2024
to avoid crash when dereferencing a NULL pointer.

Reported-by: Trzik on github
Patch-by: Trzik on github
Fixes #13684
@bagder bagder closed this as completed in 13ca438 May 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Successfully merging a pull request may close this issue.

2 participants