# CVE-2019-5482: Heap buffer overflow in TFTP when using small blksize

curl's TFTP client, after the CVE-2019-5436 fix, mishandles servers that ignore blksize and send 512-byte blocks, causing silent file truncation.

- Payout: hidden
- Severity: medium
- Program: curl
- Found by: thomas_v
- Disclosed: 2020-11-14
- CVE: CVE-2019-5482, CVE-2019-5436
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/684603
- Library page: https://bugbountylibrary.com/r/h1%3A684603
- Tags: area:devices domain:network impact:integrity kind:bounty platform:hackerone sev:medium tech:curl technique:incomplete-fix technique:regression vuln:dos vuln:memory-corruption

**Target:** curl TFTP client (tftp.c recvfrom buffer sizing)
**Root cause:** Commit 257600341 sized the receive buffer to the requested blksize instead of at least 512 bytes; when the server ignores the blksize request and sends a default 512-byte block without OACK, curl treats it as EOF and returns success.
**Steps:**
1. Run a TFTP server that ignores blksize requests and sends default 512-byte blocks without OACK.
2. Execute `curl --tftp-blksize 8192 tftp://9.1.9.1/data.bin --output data.bin`.
3. Observe `echo $?` returns 0 and data.bin is truncated to 512 bytes.
**How found:** Researcher noticed the CVE-2019-5436 fix (tftp: use the current blksize for recvfrom()) changed buffer sizing; reasoned from RFC that a server may ignore blksize and still send 512-byte blocks, then tested against such a server.
**Insight:** When auditing fixes for prior CVEs, check whether the new assumption (here: server honors requested blksize) is actually guaranteed by the protocol; RFC-permitted server behavior can reintroduce bugs.