Also, the bot filed another issue on a different repo referencing the source issue, despite the complaints: https://github.com/mirror/wget/issues/25
The reporting is terrible though. Publicly releasing severe vulnerabilities is not very ethical. But they also called it severe without actually analyzing it.
Their AI really looks like a useful tool, but that's not the best way to show it off to say the least.
Is it a commercial system and is their intention to advertise that they found a severe vulnerability in curl with it?
Making assumptions about what the code should be reasonably interpreted as is unfortunately not a good bet to make.
At any time, a new compiler version may do something bizarre when it figures out the code is UB.
"We assume 64 bit overflow is not going to happen because nobody can store that many bytes" could be valid if the existence of those bytes was required for reaching this code. But if user input can lead to UB being triggered here, fixing the code is indeed prudent, even if everyone were fully convinced that current compilers are not outsmarting themselves.
Not sure if I'd be snarky for the first few clueless reports, but I'd probably be getting there after several of them have happened.
Tell them privately first, ideally with a repro
