# CVE-2019-5436: Heap Buffer Overflow at lib/tftp.c

curl's TFTP client used default blksize instead of the --tftp-blksize value in recvfrom, causing a heap overflow when blksize < 293.

- Payout: hidden
- Severity: low
- Program: curl
- Found by: l00p3r
- Disclosed: 2019-05-31
- CVE: CVE-2019-5436
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/550696
- Library page: https://bugbountylibrary.com/r/h1%3A550696
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:curl technique:source-review vuln:dos vuln:memory-corruption

**Target:** TFTP client in lib/tftp.c
**Root cause:** state->blksize held the default size rather than the user-specified --tftp-blksize, so recvfrom read state->blksize+4 bytes into a buffer sized for the smaller configured block, overflowing the heap.
**Steps:**
1. Run malicious server: `python evil-server.py IP PORT`
2. Connect with curl using a small block size: `curl --tftp-blksize N tftp://IP:PORT` where N < 293
3. Server sends a packet larger than the allocated rpacket buffer, overflowing the heap in recvfrom at lib/tftp.c:1114
**How found:** Code reading of lib/tftp.c recvfrom call revealed state->blksize was not updated from the --tftp-blksize option, so buffer size and read length diverged.
**Exploitation:** Attacker controls a TFTP server; victim must explicitly pass --tftp-blksize below 293. Server sends oversized data causing heap overflow; RCE requires an additional memory leak.
**Insight:** When a CLI option overrides a default, verify every downstream use of the struct field is updated; here the recv length used the stale default while the buffer was sized from the option.

## Write-ups of the same bug (oldest first)
- 2019-05-31: [CVE-2019-5436: Heap Buffer Overflow at lib/tftp.c](https://bugbountylibrary.com/r/h1%3A550696) — l00p3r (this one)
- 2020-11-14: [CVE-2019-5482: Heap buffer overflow in TFTP when using small blksize](https://bugbountylibrary.com/r/h1%3A684603) — thomas_v