romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 14:33:44 +03:00
Code Issues Projects Releases Packages Wiki Activity

socks: avoid UAF risk in error path

Browse source 
The code obtained a pointer resp via Curl_bufq_peek(), but called
Curl_bufq_skip() before it would access them in the failf() call.

The Curl_bufq_skip() call can trigger prune_head which may free or
recycle the chunk that resp points into.

Pointed out by ZeroPath
Closes #19139
This commit is contained in:
Daniel Stenberg 2025-10-19 12:17:45 +02:00
parent f03e7c1d64
commit 8d302ec936
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/socks.c
View file

@ -765,13 +765,12 @@ static CURLproxycode socks5_check_auth_resp(struct socks_state *sx,
/* ignore the first (VER) byte */ /* ignore the first (VER) byte */
auth_status = resp[1]; auth_status = resp[1];
Curl_bufq_skip(&sx->iobuf, 2);
if(auth_status) { if(auth_status) {
failf(data, "User was rejected by the SOCKS5 server (%d %d).", failf(data, "User was rejected by the SOCKS5 server (%d %d).",
resp[0], resp[1]); resp[0], resp[1]);
return CURLPX_USER_REJECTED; return CURLPX_USER_REJECTED;
} }
Curl_bufq_skip(&sx->iobuf, 2);
return CURLPX_OK; return CURLPX_OK;
} }