curl’s accidental Turing-completeness in versions 8.12-8.16 resolved with version 8.17
The article details a technical quirk in the curl command-line tool that made it accidentally Turing-complete for a period of nine months, from version 8.12 through 8.16. During this time, curl’s configuration file handling allowed for variable slicing and recursive file inclusion without a depth limit. This combination enabled curl to simulate any two-counter Minsky program, which is theoretically Turing-complete under idealized conditions of unbounded resources. The article explains the technical implementation, including how counter values were represented using string manipulations and how configuration files acted as labels for program states. A proof-of-concept demonstrating the addition of 2 + 3 was provided, along with instructions for building a local curl 8.12.0 binary to test the behavior. The article also discusses the practical limitations of this Turing-completeness, noting that real-world constraints like memory limits (10,000,000 bytes for expanded content) and stack size restrictions (922 steps before a segfault in a minimal countdown loop) prevented actual infinite computation. The issue was resolved in curl 8.17.0, which introduced a five-level include cap that broke the reduction. The author notes that while a Bash while loop could complement curl to achieve Turing-completeness through external iteration, this would be a composition rather than standalone curl Turing-completeness. The security impact of this quirk was deemed none, as it required specific configuration patterns that would not be encountered in typical usage. The article concludes with a humorous note about a user implementing ’99 Bottles of Beer on the Wall’ using curl configuration files.
