CVE-2017-13089: Wget Stack Overflow in Chunked Transfer Encoding Handler

GNU wget versions up to 1.19.1 contain a stack-based buffer overflow vulnerability in the skip_short_body() function when processing HTTP responses with chunked transfer encoding. The vulnerability occurs because chunk sizes are read using strtol() without validation for negative values. When a malicious HTTP server sends a negative chunk size (e.g., '-1' or '-ffffffff'), the resulting negative value is used as a size parameter to fd_read(), which implicitly casts it to unsigned. This causes the function to attempt reading an enormous amount of data into a 512-byte stack-allocated buffer, resulting in stack corruption and potential code execution.

Located the vulnerability by examining the skip_short_body() function in http.c (lines 946-1020). The function handles skipping HTTP response bodies with chunked transfer encoding. The vulnerable code path: (1) Line 968 reads chunk size line via fd_read_line(), (2) Line 973 parses it with strtol(line, &endl, 16) without validation, (3) If the server sends a negative chunk size like '-1', strtol returns a negative wgint, (4) Line 984 calculates contlen = MIN(negative_value, 512), (5) Line 989 passes this to fd_read(fd, dlbuf, ...) where dlbuf is only 512 bytes. The negative size parameter triggers integer underflow/overflow behavior in fd_read's type system, causing reads of gigabytes of data into the small stack buffer.", "solution_description": "The fix requires adding validation after strtol() to reject negative or invalid chunk sizes. The proper check is to verify that remaining_chunk_size >= 0 before using it in any size calculations. If a negative value is encountered, the function should return an error (false) to indicate the malformed response. This prevents the implicit type conversion vulnerability by catching invalid input at the parsing stage rather than in the memory operation.", "verification_notes": "The vulnerability can be verified by: (1) Creating an HTTP response with 'Transfer-Encoding: chunked' header, (2) Sending a negative chunk size in the chunk header (e.g., '-1\r\n'), (3) Following with sufficient data to exceed 512 bytes, (4) Observing that wget crashes or exhibits memory corruption symptoms such as stack corruption markers appearing in crash dumps. Testing against wget v1.19.2+ confirms the fix prevents the overflow by rejecting the malformed chunk size.", "error_category": "runtime", "error_type": "CWE-121 Stack-based Buffer Overflow", "root_cause_type": "version_mismatch", "severity": "critical", "bug_class": "stack-overflow", "lang": "c", "lib_versions": { "wget": "1.19.1" }, "tags": ["CVE-2017-13089", "stack-overflow", "wget", "buffer-overflow", "chunked-encoding", "integer-underflow"], "artifacts": [ { "kind": "code-excerpt", "content": "remaining_chunk_size = strtol (line, &endl, 16);\nxfree (line);\nif (remaining_chunk_size == 0) { ... break; }\ncontlen = MIN (remaining_chunk_size, SKIP_SIZE);\nret = fd_read (fd, dlbuf, MIN (contlen, SKIP_SIZE), -1);", "language": "c", "role": "manifests", "source_path": "src/http.c", "source_lines": [973, 989] } ], "domain": "HTTP Protocol Parsing" }