Living Off The Land: Exploiting Memory Safety in libcurl Without Touching Its Source

If you spend enough time in the weeds of C code, you’ll notice a peculiar thing about “not a bug” reports: they often are bugs — just bugs whose triggers live at the API boundary rather than in the library’s internals. libcurl is an incredible piece of software. It moves bits across the network for everything from embedded devices to cloud services. But like most C libraries, it assumes that the…