David Carlier

An out-of-bounds read occurs in the HTTP stream wrapper when following a redirect where the response contains a `Location` header with an empty value. The redirect code reads one byte beyond the end of the heap buffer storing the location. A malicious server can leverage the value of this byte to control whether the client is redirected to the host root or the current directory.

The OpenSSL extension contains a buffer allocation flaw in the AES-WRAP-PAD algorithm implementation. The output buffer for the AES key-wrap-with-padding operation is sized based on the plaintext length but fails to account for RFC 5649 expansion. This can lead to writing beyond the allocated memory, which corrupts heap metadata and may cause the application to abort. This issue occurs within the `openssl encrypt()` function.