curl: Re-entrant curl_easy_pause UAF in cw-pause

Summary This report is a bypass of the prior fix for the nested curleasypause re-entrancy issue described in HackerOne report 4102061. The original patch guarded the writer path in lib/cw-out.c by adding a re-entrancy guard around cwoutflushchain, but it did not guard the sibling writer...

curl: HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB

Hi all, When a libcurl application's CURLOPTWRITEFUNCTION returns CURLWRITEFUNCPAUSE, libcurl routes subsequent incoming body data through cw-pause lib/cw-pause.c. The bufq inside cw-pause is initialised with BUFQOPTSOFTLIMIT and a chunk size of 16 KiB lib/cw-pause.c:51-52, which causes bufq to...