Skip to content

httputil: data corruption in ResponseChain string accessors #710

@dwisiswant0

Description

@dwisiswant0

Description:

Consumers of ResponseChain methods (HeadersString() and BodyString()) may experience data corruption where string values change unexpectedly after the ResponseChain is closed.

Root cause:

The methods used conversion.String() to perform a zero-copy conversion of the underlying byte buffer.

Since ResponseChain uses a buffer pool, the memory backing these strings is returned to the pool upon Close(). When that memory is reused by a subsequent request, the original string values, which are still pointing to that memory, are overwritten.

Impact:

This causes race conditions where data read from a previous response can be mutated by a new response, leading to UB and corrupted data in downstream processing.

Additional context:

See failed tests in Nuclei: https://github.com/projectdiscovery/nuclei/actions/runs/19770495075/job/56654276664?pr=6629.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions