Vulnerability: Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Vulnerability ID: CVE-2013-2174
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/bagder/curl
Published: 2013-07-31
File: lib/escape.c
Commit message: Curl_urldecode: no peeking beyond end of input buffer

Security problem: CVE-2013-2174

If a program would give a string like "%FF" to curl_easy_unescape() but
ask for it to decode only the first byte, it would still parse and
decode the full hex sequence. The function then not only read beyond the
allowed buffer but it would also deduct the *unsigned* counter variable
for how many more bytes there's left to read in the buffer by two,
making the counter wrap. Continuing this, the function would go on
reading beyond the buffer and soon writing beyond the allocated target
buffer...

Bug: http://curl.haxx.se/docs/adv_20130622.html
Reported-by: Timo Sirainen
Commit author: Daniel Stenberg

Vulnerable version (before fix):
  *                            | (__| |_| |  _ <| |___  *                             \___|\___/|_| \_\_____|  *  * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.  *  * This software is licensed as described in the file COPYING, which  * you should have received as part of this distribution. The terms CURLcode Curl_urldecode(struct SessionHandle *data,    while(--alloc > 0) {     in = *string;     if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {       /* this is two hexadecimal digits following a '%' */       char hexstr[3];       char *ptr;

Fixed version (after fix):
  *                            | (__| |_| |  _ <| |___  *                             \___|\___/|_| \_\_____|  *  * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.  *  * This software is licensed as described in the file COPYING, which  * you should have received as part of this distribution. The terms CURLcode Curl_urldecode(struct SessionHandle *data,    while(--alloc > 0) {     in = *string;     if(('%' == in) && (alloc > 2) &&        ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {       /* this is two hexadecimal digits following a '%' */       char hexstr[3];       char *ptr;

Patch:
patch: @@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -159,7 +159,8 @@ CURLcode Curl_urldecode(struct SessionHandle *data,
 
   while(--alloc > 0) {
     in = *string;
-    if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
+    if(('%' == in) && (alloc > 2) &&
+       ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
       /* this is two hexadecimal digits following a '%' */
       char hexstr[3];
       char *ptr;
path: lib/escape.c