Bugs in all curl_set_opt calls with enum arguments as values.

[sergio-nsk]

I did this

Let's consider the example with CURLOPT_SSLVERSION.

The function synopsis

CURLcode curl_easy_setopt(CURL *curl, CURLoption option, ...);

The call semantics

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLVERSION, long version);

Example

curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

Reading the value (shortened)

  case CURLOPT_SSLVERSION:
      arg = va_arg(param, long);

The issue on all 64 bit OSes except Windows: the enum value CURL_SSLVERSION_TLSv1 promoted to int (32 bit) is used for the call to the variable arg function, the value is read as long (64 bit), a possible buffer over-read vulnerability.

I expected the following

enum values are passed as long values.

curl/libcurl version

libcurl 7.84.0

operating system

Ubuntu 22.04.1, macOS 12.4

[bagder]

The documentation for this option says:

Pass a long as parameter to control...

A long.

[sergio-nsk]

The documentation for this option says:

Pass a long as parameter to control...

A long.

Right. And the example in the documentation passes int.