It's surprising that this could even cause a crash, much less code execution, since if it really is an integer overflow I'd expect the range to wrap around (mod 2^n) and you'd just get a different part of the file you were requesting (e.g. with 32-bit maths, asking for bytes 0-4294967300 will return bytes 0-4 instead.) It looks more like a signed/unsigned confusion to me - the 1844...615 value is -1 if interpreted as a signed number, and even if this caused reading past the end of a buffer, the result would be more Heartbleed-like than code execution.
Just taking a guess here, but the code execution probably requires a POST request instead of GET. Nevertheless, it's still quite puzzling how something like this could occur.
Edit: apparently you need kernel caching of HTTP requests enabled, and at least one rule for caching, and the request has to satisfy that rule, in order to cause a crash.
Just taking a guess here, but the code execution probably requires a POST request instead of GET. Nevertheless, it's still quite puzzling how something like this could occur.
Note: I have not tested this personally. Others here https://news.ycombinator.com/item?id=9380889 say they haven't been able to reproduce it.
Edit: apparently you need kernel caching of HTTP requests enabled, and at least one rule for caching, and the request has to satisfy that rule, in order to cause a crash.