# libcurl: freeing stack buffer during x509 certificate parsing

libcurl's ASN1 utf8asn1str() calls free() on a 4-byte stack buffer when parsing an invalid UTF-8 cert field, letting a malicious TLS server corrupt stack memory.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by (vendor credit): z2_
- Found by: z2_
- Disclosed: 2024-08-23
- CVE: CVE-2024-6197
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2621057
- Library page: https://bugbountylibrary.com/r/h1%3A2621057
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:curl technique:source-review vuln:dos vuln:memory-corruption

**Target:** libcurl ASN1 UTF-8 string parser (utf8asn1str) during x509 certificate parsing
**Root cause:** utf8asn1str() allocates a 4-byte local stack buffer and, on detecting an invalid UTF-8 field, returns an error path that calls free() on that stack pointer instead of heap memory.
**Steps:**
1. Set up a malicious TLS server presenting a certificate whose ASN.1 UTF-8 string field is invalid UTF-8.
2. Client using libcurl connects and parses the cert via the ASN1 parser.
3. utf8asn1str() detects the invalid field and invokes `free()` on the 4-byte stack buffer.
4. Observe crash/abort on malloc implementations that detect the invalid free; on permissive allocators, stack memory near the buffer is overwritten.
**How found:** Code review of the ASN1 UTF-8 parsing error path revealed free() applied to a stack-local buffer rather than heap allocation.
**Exploitation:** Attacker controls a TLS server and serves a crafted certificate; when a libcurl client parses it, the invalid-free path corrupts stack memory. Most likely outcome is a crash; deeper corruption possible under special allocator circumstances.
**Insight:** Audit error/cleanup paths in parsers for free() on stack or non-heap buffers — the happy path allocates on heap but the invalid-input branch may free a local scratch buffer.