From b3c551251c197e2da219d0b31de0a58fda7a2ba6 Mon Sep 17 00:00:00 2001 From: Mateen Anjum Date: Tue, 22 Sep 2026 16:48:33 -0400 Subject: [PATCH 1/2] [BUG] Compare the curl seek offset before narrowing it to size_t HttpOperation::SeekCallback narrowed the curl_off_t offset to size_t before its range check, so on a build where size_t is 32 bits an offset above the size_t range wrapped back inside the body and the callback reported CURL_SEEKFUNC_OK for a position it had not moved to. Compare in curl_off_t, the type libcurl passes, and leave the narrowing to after the check has passed. Negative offsets were already refused by the offset < 0 term, so only the upper bound changes. Follow-up to #4557. Signed-off-by: Mateen Anjum --- ext/src/http/client/curl/http_operation_curl.cc | 3 ++- ext/test/http/curl_http_test.cc | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/ext/src/http/client/curl/http_operation_curl.cc b/ext/src/http/client/curl/http_operation_curl.cc index 8d399d5f2a..a922995971 100644 --- a/ext/src/http/client/curl/http_operation_curl.cc +++ b/ext/src/http/client/curl/http_operation_curl.cc @@ -347,7 +347,8 @@ int HttpOperation::SeekCallback(void *userp, curl_off_t offset, int origin) // move of the read cursor. Anything else is refused rather than approximated, because reporting // success without repositioning would resume the upload from the wrong offset and send a // truncated or misaligned body. - if (origin != SEEK_SET || offset < 0 || static_cast(offset) > self->request_body_.size()) + if (origin != SEEK_SET || offset < 0 || + offset > static_cast(self->request_body_.size())) { return CURL_SEEKFUNC_CANTSEEK; } diff --git a/ext/test/http/curl_http_test.cc b/ext/test/http/curl_http_test.cc index 0d7d09bd7f..aa7151798a 100644 --- a/ext/test/http/curl_http_test.cc +++ b/ext/test/http/curl_http_test.cc @@ -17,8 +17,10 @@ #include #include #include +#include #include #include +#include #include #include #include @@ -506,6 +508,12 @@ TEST_F(BasicCurlHttpTests, SeekCallbackRepositionsTheRequestBody) EXPECT_EQ(CURL_SEEKFUNC_CANTSEEK, Peer::Seek(operation, -1, SEEK_SET)); EXPECT_EQ(CURL_SEEKFUNC_CANTSEEK, Peer::Seek(operation, 0, SEEK_CUR)); EXPECT_EQ(CURL_SEEKFUNC_CANTSEEK, Peer::Seek(operation, 0, SEEK_END)); + + // An offset past the range of size_t must stay out of range. Narrowing it to size_t first + // wrapped it back into the body on a build where size_t is 32 bits. + EXPECT_EQ(CURL_SEEKFUNC_CANTSEEK, + Peer::Seek(operation, static_cast(std::numeric_limits::max()) + 4, + SEEK_SET)); EXPECT_EQ(3u, Peer::ReadCursor(operation)); EXPECT_EQ(CURL_SEEKFUNC_CANTSEEK, Peer::SeekNullUserData(0, SEEK_SET)); From c06f061c51d09e9b00277d5c72d12d23d54feacd Mon Sep 17 00:00:00 2001 From: Mateen Anjum Date: Tue, 22 Sep 2026 20:12:11 -0400 Subject: [PATCH 2/2] Add the CHANGELOG entry Signed-off-by: Mateen Anjum --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e203290157..f944cdd0dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,11 @@ Increment the: ## [Unreleased] +* [BUG] Compare the curl seek offset in `curl_off_t` before narrowing it to + `size_t`, so an offset past the `size_t` range cannot wrap back inside the + request body on a 32-bit build + [#4630](https://github.com/open-telemetry/opentelemetry-cpp/pull/4630) + * [EXAMPLES] Fix random attribute selection in metrics foo example to include all key-value pairs [#4585](https://github.com/open-telemetry/opentelemetry-cpp/pull/4585)