Closed Fusl closed 6 months ago
hmm digging into this more, it seems like something seriously breaks when its decoding a query greater that 32 with a null in the string. very strange. it breaks in a similar way if you do ./trurl "0?f=0%000000000000000000000000000000" --json
it works fine (here the entire query string is exactly 32 characters. if you add a single 0
to the send it totally breaks down as well. though I should note this happens at appqpair
and not in JsonString, where your example is breaking.
I also wouldn't be surprised if it has a similar root cause https://github.com/curl/trurl/issues/262
This is very similar to https://github.com/curl/trurl/issues/265 but unsure if it's the same root cause so I'm opening a separate issue. Please close this one if they appear to be the same root cause.
trurl incorrectly decodes a
%00
found in the query string part of a URL which causes an out of bound reads when trying to print the result with--json
.Example (note the random data in the
key
of the param):With ASan enabled:
This bug was discovered with the help of AFL++ in combination with ASan.