bagder

#!/bin/sh
#
# converts "icing:tool-synthetic-error-handling"
# to
# "git pull git@github.com:icing/curl.git tool-synthetic-error-handling"
#
# or
# "https://github.com/mvanslobbe/curl-fork/tree/perf/ws-mask-chunks"
# to
# "git pull git@github.com:mvanslobbe/curl-fork.git perf/ws-mask-chunks"

bagder

Title: Patch Me If You Can

Alternative: Free Code, Expensive Problems

Alternative2: Zero Days, Zero Sleep

Abstract

Picking up where last year’s FOSDEM presentation left off, Daniel Stenberg dives into the shifting front lines of the open source security vulnerability

bagder

Download 100G single transfer HTTP:// (6 samples)

Minimum: 19084984 milliseconds
P25:     19408571 milliseconds
Median:  19510998 milliseconds
P75:     19738877 milliseconds
Maximum: 19889887 milliseconds
Average: 19524052 milliseconds
Span:    +-402451 milliseconds, 2.061% of average

Allocations for a single HTTP transfer (6 samples)

Minimum: 105 allocations

bagder

diff --git a/src/tool_operate.c b/src/tool_operate.c
index f402c3f055..3e6038d9a6 100644
--- a/src/tool_operate.c
+++ b/src/tool_operate.c
@@ -854,10 +854,11 @@ static CURLcode post_close_output(struct per_transfer *per,
   int rc;
 
   /* Close the outs file */
   if(outs->fopened && outs->stream) {
     rc = curlx_fclose(outs->stream);

bagder

curl security review log

Started: 2026-05-06
Commit: 455bebc2c7 (master)
Scope: 178k LoC C, lib/ + src/
Code links: https://github.com/curl/curl/tree/455bebc2c76223a1be26042f6d2393715c0df0cd (all line refs below pin to this commit)

Approach

curl is one of the most fuzzed and audited C codebases in existence (OSS-Fuzz, Coverity, CodeQL, multiple paid audits). Finding anything in the hot paths (HTTP/1, TLS, URL parsing core) is unlikely. Focus instead on:

bagder

<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTP GET
</keywords>
</info>
# Server-side
<reply>

bagder

curl security reporting wishlist

1. Incoming submissions are reports that identify security problems.
2. The reporter needs an account on the system.
3. Submissions start private; only accessible to the reporter and the curl security team
4. All submissions should be disclosed and make public once dealt with. Both correct and incorrect ones.
5. There should be a way to discuss the problem amongst security team members, the reporter and per-report invited guests.
6. It should be possible to post security-team-only messages that the reporter and invited guests cannot see
7. For confirmed vulnerabilities, an advisory will be produced that the system could help fascilitate
8. If there's a field for CVE, make it possible to provide our own

bagder

GitHub Security Advisory wishlist from the curl project

1. GitHub sends the whole report over email/notification with no way to disable this. SMTP and email is known for being insecure and cannot assure end to end protection. This risks leaking secrets early to the entire email chain.

2. can't properly disclose invalid ones (and make them clearly marked as such)

3. Per-repo default collaborators on GitHub Security Advisories is annoying as we now have to manually add the security team for each advisory or have a rather quirky workflow scripting it.

bagder

Slop

This collection is limited to only include the reports that were submitted as security vulnerabilities to the curl bug-bounty program on Hackerone.

Several other issues not included here are highly suspcious as well.

Reports

1. [Critical] Curl CVE-2023-38545 vulnerability code changes are disclosed on the internet. #2199174

bagder

==450632== 
==450632== HEAP SUMMARY:
==450632==     in use at exit: 13,496 bytes in 331 blocks
==450632==   total heap usage: 5,306 allocs, 4,975 frees, 581,992 bytes allocated
==450632== 
==450632== 24 bytes in 1 blocks are definitely lost in loss record 12 of 81
==450632==    at 0x4844818: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==450632==    by 0x153E93: curl_dbg_malloc (memdebug.c:145)
==450632==    by 0x174753: Curl_memdup (strdup.c:93)
==450632==    by 0x1E7CD9: Curl_httpsrr_set (httpsrr.c:103)