XPost: linux.debian.devel.release
package: release.debian.org
control: affects -1 + src:curl
x-debbugs-cc:
[email protected]
user:
[email protected]
usertags: pu
tags: bookworm
severity: normal
[ reason ]
curl upstream has reached out to report a memory-leak affecting the version we ship in bookworm [0].
This problem was inadvertently fixed for trixie on a refactor of the affected code.
I suspect this problem also affects bullseye but I have not looked into it yet, for now I'd like to fix it in bookworm.
[ impact ]
This is fixing a memory-leak.
The leak is small, within the bytes range, and likely to not be noticed by a lot of users, but there was a request to fix it and the patch is simple.
[ tests ]
curl has an extensive testsuite and all tests passed, curl also contains a lot of reverse-dependencies in the archive and their debci results will reduce the likelihood of regressions.
[ risks ]
Given the patch is freeing a buffer instead of resetting it, there's a risk of introducing an UAF.
I have analyzed the code and have not spotted any problems with it, on top of this, Daniel Stenberg also acked the patch [0].
[ checklist ]
� [x] *all* changes are documented in the d/changelog
� [x] i reviewed all changes and i approve them
� [x] attach debdiff against the package in (old)stable
� [x] the issue is verified as fixed in unstable
[ changes ]
There's a single change which is adding a patch vetted by the upstream developer.
The patch modifies a single line of code to free a buffer instead of resetting it and keeping the allocation.
[ other info ]
Discussion in GitHub:
https://github.com/curl/curl/issues/17749
[0]
https://curl.se/mail/distros-2025-07/0001.html
--
Samuel Henrique <samueloph>
diff -Nru curl-7.88.1/debian/changelog curl-7.88.1/debian/changelog
--- curl-7.88.1/debian/changelog 2025-06-17 01:56:01.000000000 +0200
+++ curl-7.88.1/debian/changelog 2025-07-19 21:04:59.000000000 +0200
@@ -1,3 +1,11 @@
+curl (7.88.1-10+deb12u14) bookworm; urgency=medium
+
+ * d/p/0001-http_chunks-reset...: New patch to fix memory leak:
+ - Thanks to Daniel Stenberg and dheerajsangamkar for reporting the issue
+ and writing a patch
+
+ -- Samuel Henrique <
[email protected]> Sat, 19 Jul 2025 21:04:59 +0200
+
curl (7.88.1-10+deb12u13) bookworm; urgency=medium
* Team upload.
diff -Nru curl-7.88.1/debian/patches/0001-http_chunks-reset-the-trailer-to-avoid-memory-leak.patch curl-7.88.1/debian/patches/0001-http_chunks-reset-the-trailer-to-avoid-memory-leak.patch
--- curl-7.88.1/debian/patches/0001-http_chunks-reset-the-trailer-to-avoid-memory-leak.patch 1970-01-01 01:00:00.000000000 +0100
+++ curl-7.88.1/debian/patches/0001-http_chunks-reset-the-trailer-to-avoid-memory-leak.patch 2025-07-19 21:04:59.000000000 +0200
@@ -0,0 +1,31 @@
+From 18426