# curl: stack-buffer overread during punycode conversions

curl's URL API punycode conversion of a 256-byte domain with macidn backend reads past a stack buffer, leaking adjacent stack memory into the result.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by (vendor credit): z2_
- Found by: z2_
- Disclosed: 2024-09-22
- CVE: CVE-2024-6874
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2621062
- Library page: https://bugbountylibrary.com/r/h1%3A2621062
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:low tech:curl technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** libcurl URL API curl_url_get() punycode/IDN conversion
**Root cause:** The macidn IDN backend fills the provided buffer exactly without null-terminating when converting a 256-byte name, so the conversion result reads past the stack buffer bounds.
**Steps:**
1. Build libcurl with the macidn IDN backend
2. Call curl_url_get() requesting punycode conversion of a domain name exactly 256 bytes long
3. Observe the returned converted string includes adjacent stack memory beyond the buffer
**Insight:** Exact-buffer-length inputs (256 bytes) probe off-by-one/null-termination gaps in conversion backends; test each IDN backend separately since behavior differs.