Integer overlow in "header_append" function

Summary: The function header_append contains an integer overflow, it can bypass the check on the length and can lead to a subsequent heap buffer overflow.

static CURLcode header_append(struct Curl_easy *data,
                              struct SingleRequest *k,
                              size_t length)
{
  size_t newsize = k->hbuflen + length; // <-- here there is the point of the integer overflow (length is user controllable)
// the value of …