Heap overflow in HTTP Response Status Message

[0xacb]

I'm opening a public issue since it's the only option, according to @ismaell

There's a heap overflow bug in src/http.c when an HTTP status message is longer than expected, leading to potential arbitrary code execution when Axel is used to retrieve attacker-controlled content.

Steps to reproduce:

1. Run the provided flask app heap-overflow-poc.py
2. Use axel to fetch the provided endpoints
3. Observe the crashes

root@machine:~/axel# ./axel http://localhost/c1/x
Initializing download: http://localhost/c1/x
ERROR 302: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.
double free or corruption (!prev)
Aborted (core dumped)
root@machine:~/axel# ./axel http://localhost/c2/x
Initializing download: http://localhost/c2/x
realloc(): invalid next size
Aborted (core dumped)
root@machine:~/axel# ./axel http://localhost/c3/x
Initializing download: http://localhost/c3/x
Segmentation fault (core dumped)

Will open a PR shortly to address this security issue.