Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror

Disclosed: 2026-05-05 08:23:29 By ravindrasl2026 To curl
Low
Vulnerability Details
Summary: A resource leak was identified in src/tool_parsecfg.c using the Clang Static Analyzer. When a file error occurs (fileerror is true) during config parsing, the function returns PARAM_READ_ERROR without ensuring the file stream is properly closed, leading to a potential file descriptor leak. Steps to Reproduce: 1. Analyze the curl source code using scan-build make. 2. Observe the report for src/tool_parsecfg.c. 3. The analyzer identifies that at line 264, if fileerror is triggered, the control flow reaches the return statement at line 279 without a confirmed fclose on the opened stream. ## Impact Impact: A local attacker could potentially cause a Denial of Service (DoS) by repeatedly triggering this error path, leading to file descriptor exhaustion.
Actions
View on HackerOne
Report Stats
  • Report ID: 3710209
  • State: Closed
  • Substate: not-applicable
Share this report