The httpClientDiscardBody function in client.c in Polipo 0.9.8 0.9.12 1.0.4 and possibly other versions allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value which triggers an integer overflow a signed-to-unsigned conversion error with a negative value and a segmentation fault.