curl: CVE-2023-38545: socks5 heap buffer overflow

Summary: The SOCKS5 state machine can be manipulated by a remote attacker to overflow heap memory if four conditions are met: The request is made via socks5h. The state machine's negotiation buffer is smaller than ~65k. The SOCKS server's "hello" reply is delayed. The attacker sets a final destination hostname larger than the negotiation buffer. libcurl is supposed to disable SOCKS5 remote hostname resolution for hostnames larger than 255 but will not due to a state machine bug. For example tor user running libcurl app with follow location that connects to rogue onion server that replies with payload in Location: header which causes crash or worse. Walkthrough: do_SOCKS initializes local variable socks5_resolve_local depending on the CURLPROXY_ name. There are two relevant names for this state machine: CURLPROXY_SOCKS5 (SOCKS5 with local resolve of dest host) CURLPROXY_SOCKS5_HOSTNAME (SOCKS5 with remote resolve of dest host) Code: ~~~c bool socks5_resolve_local = (conn->socks_proxy.proxytype == CURLPROXY_SOCKS5) ? TRUE : FALSE; ~~~ For this scenario, CURLPROXY_SOCKS5_HOSTNAME is the name and socks5_resolve_local is initialized FALSE. The do_SOCKS state machine is entered for the first time for the connection. sx->state is CONNECT_SOCKS_INIT (which happens to be the first label). In that state the hostname length is checked and if too long to resolve remotely (>255) then it sets socks5_resolve_local to TRUE. Code: ~~~c / RFC1928 chapter 5 specifies max 255...