Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror
Low
Vulnerability Details
Summary:
A resource leak was identified in src/tool_parsecfg.c using the Clang Static Analyzer. When a file error occurs (fileerror is true) during config parsing, the function returns PARAM_READ_ERROR without ensuring the file stream is properly closed, leading to a potential file descriptor leak.
Steps to Reproduce:
1. Analyze the curl source code using scan-build make.
2. Observe the report for src/tool_parsecfg.c.
3. The analyzer identifies that at line 264, if fileerror is triggered, the control flow reaches the return statement at line 279 without
a confirmed fclose on the opened stream.
## Impact
Impact:
A local attacker could potentially cause a Denial of Service (DoS) by repeatedly triggering this error path, leading to file descriptor exhaustion.
Actions
View on HackerOneReport Stats
- Report ID: 3710209
- State: Closed
- Substate: not-applicable