Unfortunately, in C, signed overflow is undefined behavior. Anything can happen, and you should not assume that it is just benign behavior like wraparound. Undefined behavior, in a seemingly unrelated area, can result in a security issue somewhere else in the program thanks to how C deals with undefined behavior.
While I don’t think it is as severe as the CVE indicated, something that triggers undefined behavior in C is not to be dismissed as lightly as the article is doing.
https://github.com/curl/curl/pull/4166/commits/a42a763ebde64...
It seems the code is using a signed long.
Unfortunately, in C, signed overflow is undefined behavior. Anything can happen, and you should not assume that it is just benign behavior like wraparound. Undefined behavior, in a seemingly unrelated area, can result in a security issue somewhere else in the program thanks to how C deals with undefined behavior.
While I don’t think it is as severe as the CVE indicated, something that triggers undefined behavior in C is not to be dismissed as lightly as the article is doing.