# CVE-2019-5435: An integer overflow found in /lib/urlapi.c

Integer overflow in curl's urlapi.c seturl() when malloc(urllen*2+2) wraps on 32-bit with a ~2GB URL, causing heap buffer overrun.

- Payout: hidden
- Severity: low
- Program: curl
- Found by: 1wc
- Disclosed: 2020-12-05
- CVE: CVE-2019-5435, CVE-2018-14618
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/547630
- Library page: https://bugbountylibrary.com/r/h1%3A547630
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:curl technique:source-review vuln:memory-corruption

**Target:** libcurl URL API (lib/urlapi.c seturl via curl_url_set)
**Root cause:** urllen = strlen(url) is multiplied by 2 and added to 2 without overflow check before malloc; on 32-bit size_t this wraps for URLs near 2GB, allocating a too-small scratch buffer.
**Steps:**
1. Read lib/urlapi.c seturl(): `path = u->scratch = malloc(urllen * 2 + 2);` with no overflow guard.
2. Trace call path: curl_url_set(CURLUPART_URL) -> parseurl() -> seturl().
3. On a 32-bit build, pass a URL of length near 2GB to curl_url_set so urllen*2+2 wraps.
4. Subsequent writes into the undersized scratch buffer overrun the heap.
**How found:** Code review of urlapi.c allocation arithmetic, noting the missing overflow check and recalling the similar CVE-2018-14618; traced the call path from curl_url_set to confirm reachability.
**Insight:** When auditing size calculations, check every `len * N + C` passed to malloc for wraparound on 32-bit size_t; URL/string parsers that allocate 2x scratch buffers are prime spots, and prior sibling CVEs in the same file signal recurring patterns.