Heap‑based buffer overflow in curl -K <config_file> allows arbitrary write .

Summary: A heap‑based buffer overflow in curl’s config‑file parser (`parseconfig()` --> `getparameter()`) allows an attacker supplying a crafted config file to overwrite internal pointers (via `cleanarg()`), leading to a write‑what‑where primitive and potential remote code execution.

2898     case C_USER: /* --user */
2899       /* user:password  */
2900       err = getstr(&config->userpwd, nextarg, ALLOW_BLANK); //------set break point here  ----
2901       cleanarg(clearthis);                                  //--------- set break point here  --------       
2902       break;