How I made a heap overflow in curl (daniel.haxx.se)

submitted 8 months ago by pnutzh4x0r@lemmy.ndlug.org to c/opensource@lemmy.ml

6 comments fedilink hide all child comments

In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH.

While the advisory contains all the necessary details. I figured I would use a few additional words and expand the explanations for anyone who cares to understand how this flaw works and how it happened.

you are viewing a single comment's thread
view the rest of the comments

[-] onlinepersona@programming.dev 8 points 8 months ago

He brings up the "just rewrite in rust" argument. Curious as I am, I had a look and only found a single project that actually tried it https://github.com/TogarashiPepper/curl

It didn't get very far.