mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-11-27 05:50:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

VULN-DISCLOSURE-POLICY: NULL dereferences and crashes

Browse Source 
If a malicious server can trigger a NULL dereference in curl or
otherwise cause curl to crash (and nothing worse), chances are big that
we do not consider that a security problem.

Closes #13974
This commit is contained in:
Daniel Stenberg 2024-06-19 11:47:26 +02:00
parent b4ccf3fcbe
commit b715bb371c
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.github/scripts/spellcheck.words vendored
View File

@ -174,6 +174,8 @@ decrypting
deepcode
DELE
DER
dereference
dereferences
deselectable
deserialization
Deserialized
@ -508,8 +510,8 @@ monospace
MorphOS
MPE
MPL
MPTCP
mprintf
MPTCP
MQTT
mqtt
mqtts

15
docs/VULN-DISCLOSURE-POLICY.md
View File

@ -298,3 +298,18 @@ is curl working as designed and is not a curl security problem. Escape
sequences, moving cursor, changing color etc, is also frequently used for
good. To reduce the risk of getting fooled, save files and browse them after
download using a display method that minimizes risks.
## NULL dereferences and crashes
If a malicious server can trigger a NULL dereference in curl or otherwise
cause curl to crash (and nothing worse), chances are big that we do not
consider that a security problem.
Malicious servers can already cause considerable harm and denial of service
like scenarios without having to trigger such code paths. For example by
stalling, being terribly slow or by delivering enormous amounts of data.
Additionally, applications are expected to handle "normal" crashes without
that being the end of the world.
There need to be more and special circumstances to treat such problems as
security issues.