Slop Shield triage board
Project slop-shield on GitLab · every number below is read live from the public GitLab API
12 reports triaged
Outcomes
3
Invented
a key claim is refuted with evidence
3
Wrong version
the code exists, at another version
2
Conclusion does not follow
the code is real, the conclusion is not
2
Confirmed
every key claim matches the code
2
Needs a human
could not be settled from code
To read by hand
Before Slop Shield
12
every incoming report is read in full by a maintainer
After Slop Shield
4
3 closed with evidence (a key claim refuted), 5 proposed to close: a maintainer confirms from the evidence note
Reports
| Issue | Report | Outcome | State |
|---|---|---|---|
| #13 | SS-R01 curl 8.13.0: claimed stack recursion in an HTTP/3 priority-frame handler | Invented | closed |
| #14 | SS-R02 curl (OS/400 port): claimed stack overflow from strcpy in an LDAP error-string helper proposed close | Wrong version | opened |
| #15 | SS-R03 curl (AmigaOS port): claimed heap overflow in the hostname resolver buffer | Invented | closed |
| #16 | SS-R04 curl: claimed NULL dereference through a binary-mode macro in a header that has moved proposed close | Wrong version | opened |
| #17 | SS-R05 curl 8.7.1: claimed buffer overflow from strcpy in the WebSocket handshake proposed close | Wrong version | opened |
| #18 | SS-R06 curl: claimed integer overflow in the cookie Max-Age overflow check proposed close | Conclusion does not follow | opened |
| #19 | SS-R07 curl: deep MIME nesting overflows the stack when the structure is freed needs security | Needs a human | opened |
| #20 | SS-R08 QEMU 9p: claimed race on a fid path leading to guest escape needs security | Confirmed | opened |
| #21 | SS-R09 GLib kqueue file monitor: claimed cancel-versus-rescan race leaving a stale pointer needs security | Needs a human | opened |
| #22 | SS-S01 hdrchunk 0.1.0: chunked decoder enforces the body limit per chunk, not in total syntheticneeds security | Confirmed | opened |
| #23 | SS-S02 hdrchunk 0.1.0: claimed heap overflow when copying long chunk extensions synthetic | Invented | closed |
| #24 | SS-S03 hdrchunk 0.1.0: claimed request smuggling through lenient chunk-size parsing syntheticproposed close | Conclusion does not follow | opened |
Confirmed report → fix
Merge request !6 Fix SS-S01: enforce max_body on the total of a chunked body (hdrchunk 0.1.1)
pipelines, oldest first: failed → success
pipelines, oldest first: failed → success
Releases
hdrchunk 0.1.1 (v0.1.1, 2026-10-20)
- Issue: decode_chunked enforced max_body on each chunk, not on the total body. A peer could send a body as many chunks, each under the limit, and the decoder returned a body larger than the caller allowed: memory use grew with the input instead of stopping at the configured limit.
- Weakness: CWE-770, Allocation of Resources Without Limits or Throttling.
- Affected versions: hdrchunk 0.1.0 (tag v0.1).
- Fixed version: hdrchunk 0.1.1 (tag v0.1.1).
- Severity (suggestion, a maintainer decides): Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3). Only availability is affected; the real impact depends on how much input the calling application buffers before it decodes.
- Fix: !6. decode_chunked now compares the running total with max_body before it accepts each chunk. Regression tests in lib/tests/test_chunked.py.
- Reproduction: the repro CI job runs a minimal test in a sandbox without network. It fails on 0.1.0 and passes on 0.1.1.
- Credit: reported via Slop Shield demo report SS-S01, synthetic (#8). The confidential tracking issue is #9.
Rehearsal runs (not counted)
9 issues from test runs of the flow. Count them too.
- #2 [flow proof] [SS-R01] curl 8.13.0: claimed stack recursion in an HTTP/3 priority-frame handler — Invented, closed
- #3 [flow proof] [SS-S01] hdrchunk 0.1.0: chunked decoder enforces the body limit per chunk, not in total — Confirmed, closed
- #5 [accept] [SS-R03] curl (AmigaOS port): claimed heap overflow in the hostname resolver buffer — Conclusion does not follow, closed
- #6 [accept] [SS-R05] curl 8.7.1: claimed buffer overflow from strcpy in the WebSocket handshake — Wrong version, closed
- #7 [accept] [SS-R08] QEMU 9p: claimed race on a fid path leading to guest escape — Needs a human, closed
- #8 [accept] [SS-S01] hdrchunk 0.1.0: chunked decoder enforces the body limit per chunk, not in total — Confirmed, closed
- #10 [accept] [SS-R01] curl 8.13.0: claimed stack recursion in an HTTP/3 priority-frame handler — Invented, closed
- #11 [fix] [SS-R03] curl (AmigaOS port): claimed heap overflow in the hostname resolver buffer — Invented, closed
- #12 [fix] [SS-R08] QEMU 9p: claimed race on a fid path leading to guest escape — Confirmed, closed