libcurl recently got CVE-2016-7167 for 1: https://curl.haxx.se/docs/adv_20160914.html https://curl.haxx.se/docs/adv_20160914.html "The provided string length

libcurl recently got CVE-2016-7167 for 1: https://curl.haxx.se/docs/adv_20160914.html https://curl.haxx.se/docs/adv_20160914.html "The provided string length arguments were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into."