[Bug 1860693] [NEW] curl segfaults during network access with invalid -F argument

[Matthew Toseland]

Public bug reported:

mjt at i4-desktop:~/tmp$ vi 1.html
mjt at i4-desktop:~/tmp$ curl -F'file=1.html' http://0x0.st
Segmentation fault
mjt at i4-desktop:~/tmp$ curl -v -F'file=1.html' http://0x0.st
* Rebuilt URL to: http://0x0.st/
*   Trying 136.243.89.164...
* TCP_NODELAY set
* Connected to 0x0.st (136.243.89.164) port 80 (#0)
> POST / HTTP/1.1
> Host: 0x0.st
> User-Agent: curl/7.58.0
> Accept: */*
> Content-Length: 145
> Content-Type: multipart/form-data; boundary=------------------------ee207a15c83a6272
> 
< HTTP/1.1 400 BAD REQUEST
< Server: nginx
< Date: Thu, 23 Jan 2020 16:36:43 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 19
< Connection: keep-alive
* HTTP error before end of send, stop sending
< 
Segmentation fault
* Closing connection 0

mjt at i4-desktop:~/tmp$ curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.1 zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL 

mjt at i4-desktop:~/tmp$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.3 LTS
Release:	18.04
Codename:	bionic

** Affects: curl (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to curl in Ubuntu.
https://bugs.launchpad.net/bugs/1860693

Title:
  curl segfaults during network access with invalid -F argument

Status in curl package in Ubuntu:
  New

Bug description:
  mjt at i4-desktop:~/tmp$ vi 1.html
  mjt at i4-desktop:~/tmp$ curl -F'file=1.html' http://0x0.st
  Segmentation fault
  mjt at i4-desktop:~/tmp$ curl -v -F'file=1.html' http://0x0.st
  * Rebuilt URL to: http://0x0.st/
  *   Trying 136.243.89.164...
  * TCP_NODELAY set
  * Connected to 0x0.st (136.243.89.164) port 80 (#0)
  > POST / HTTP/1.1
  > Host: 0x0.st
  > User-Agent: curl/7.58.0
  > Accept: */*
  > Content-Length: 145
  > Content-Type: multipart/form-data; boundary=------------------------ee207a15c83a6272
  > 
  < HTTP/1.1 400 BAD REQUEST
  < Server: nginx
  < Date: Thu, 23 Jan 2020 16:36:43 GMT
  < Content-Type: text/html; charset=utf-8
  < Content-Length: 19
  < Connection: keep-alive
  * HTTP error before end of send, stop sending
  < 
  Segmentation fault
  * Closing connection 0

  mjt at i4-desktop:~/tmp$ curl --version
  curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.1 zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
  Release-Date: 2018-01-24
  Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp 
  Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL 

  mjt at i4-desktop:~/tmp$ lsb_release -a
  No LSB modules are available.
  Distributor ID:	Ubuntu
  Description:	Ubuntu 18.04.3 LTS
  Release:	18.04
  Codename:	bionic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/curl/+bug/1860693/+subscriptions