Some question about CVE-2022-35260
陈星杵 via curl-library <[email protected]>
| Newsgroups | gmane.comp.web.curl.library |
|---|---|
| Message-ID | <[email protected]> |
Hello! As stated on the website，the root cause about CVE-2022-35260[1] is the fgets lack the check of '\n', so curl can read past the end of the stack-based buffer. On this basis, I think the root cause is the line 85 of the patch, but the website show me the eeaae10c0fb27aa06[2] is the Vulnerability introduced commit. I want to know Where did my understanding go wrong. Thanks very much! [1] https://curl.se/docs/CVE-2022-35260.html [2] https://github.com/curl/curl/commit/eeaae10c0fb27aa06 -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.html