In the configuration files, curl accidentally realized Turing completeness.

The capability to create any computable functions using constructs in the configuration files of the Curl utility has been identified. This feature only appears in versions of Curl from 8.12 to 8.16 and is caused by an unintentional implementation of Turing completeness, allowing the creation of Turing machines by extracting byte ranges from variable values and allowing unlimited nesting depth when including external configuration files.

For example, Curl has been used to simulate the operation of a two-counter register machine (Minsky machine) for adding numbers and implementing the '99 Bottles of Beer' program, which is used for training in working with loops. To run the program, which is programmed through the Curl configuration files, simply unpack the archive and execute the command 'curl -q -s -K 99_bottles/main.conf'.

The register machine is simulated by representing the counter value as a string of 'n' characters 'x'. Increment and decrement operations are implemented through string concatenation and truncation (the syntax '[0-0]' to leave the first byte and '[1-]' to leave everything except the first byte), while transitions between states are controlled by the 'expand-config' directive, which dynamically loads the next configuration file using its name as a transition label. The INCR operation in the register machine is realized as 'expand-variable = "r={{r}}x"' in the Curl configuration file, DECR as 'expand-variable = "r[1-]={{r}}"', and JMP as 'expand-config = "S.conf"'. For example, the code for calculating 2 + 3:

In practice, the computational capabilities implemented through configuration files are limited by the stack size, as each step of program execution requires loading a new nested configuration file. With an 8 MB stack, overflow occurs after approximately 922 steps. Capabilities are also influenced by the limit on the size of expanded variables (the parameter MAX_EXPAND_CONTENT is set to 10 MB) and high memory consumption due to saving all old versions of variables.

Although the identified capability is not a vulnerability in versions starting from curl 8.17, the discussed trick will no longer work due to the limitation of configuration file nesting depth to 5 levels to protect against infinite recursion.

Source: opennet.ru