地图 / 34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure

34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure

信息泄露 / Unlabeled / #3972196

厂商: curl
严重程度: 未评级
赏金: —
弱点: Unlabeled
研究员: @giant_anteater
披露日期: 2026-08-28
资产: https://github.com/curl/curl
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（3075 字符中的一小部分）

`docs/libcurl/curl_mprintf.md` documents that the `L` length modifier makes floating-point conversions (`%f`, `%e`, `%E`, `%g`, `%G`) accept a `long double` argument. The implementation in `lib/mprintf.c` recognizes `L` and sets `FLAGS_LONGDOUBLE`, but the conversion switch …

原文中的代码

sizeof(double)=8 sizeof(long double)=16 DBL_MANT_DIG=53 LDBL_MANT_DIG=64
%.17Lf curl=0.00000000000000000 libc=1.23456789012345679 match=no
%.17Le curl=6.95335579603750720e-310 libc=1.23456789012345679e+00 match=no
%.17LE curl=6.95335579603750720E-310 libc=1.23456789012345679E+00 match=no
%.17Lg …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。

时间线

2026-08-26报告提交
2026-08-28公开披露

阅读 HackerOne 原文 ↗作者 @giant_anteater · 版权归作者与 curl 所有

同类报告

Github access token exposureShopify · 2021-07-26 · $50,000 Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`HackerOne · 2025-01-21 · $25,000 Informations disclosure - Access to some checkout informationsShopify · 2021-03-13 Disclosure handle private program with external linkHackerOne · 2021-08-24 · $2,500 Cloudflare WAF Bypass - Origin IP ExposureHemi VDP · 2025-03-27 [Zomato Order] Insecure deeplink leads to sensitive information disclosureEternal · 2021-09-23 · $750