# CVE-2022-35260: .netrc parser out-of-bounds access

curl's .netrc parser loop scans past the stack buffer when a line lacks whitespace/newline, causing OOB read and 1-byte zero write, crashing curl.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: kurohiro
- Disclosed: 2022-12-03
- CVE: CVE-2022-35260
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1753224
- Library page: https://bugbountylibrary.com/r/h1%3A1753224
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:curl technique:source-review vuln:dos vuln:memory-corruption

**Target:** lib/netrc.c parsenetrc() .netrc file parser
**Root cause:** The token-scanning loop `while(!ISSPACE(*tok_end)) tok_end++;` lacks a NUL/bounds check, so a line of consecutive non-space chars with no trailing whitespace or newline walks past the stack buffer, then writes a zero byte out of bounds.
**Steps:**
1. Create a .netrc file whose content is 4095 'a' bytes with no whitespace or newline
2. Run `curl --netrc-file .netrc test.local`
3. Observe OOB read in parsenetrc() token loop and 1-byte OOB write of '\0' at `*tok_end = 0`
4. Crash (segfault) depending on memory state
**How found:** Code reading of parsenetrc() in lib/netrc.c: noticed the token loop only terminates on ISSPACE, and that a file ending in non-space chars without newline makes the loop run past the buffer; confirmed by crafting a 4095-byte 'a' file.
**Exploitation:** Requires attacker control over the .netrc file contents supplied to a curl/libcurl application; malformed file triggers OOB read/write leading to denial-of-service crash. No weaponization beyond DoS described.
**Insight:** When auditing parsers, check token-scan loops that terminate only on delimiter characters (ISSPACE) rather than also on NUL/end-of-buffer; a missing newline at EOF is a classic trigger for OOB reads/writes.