Page MenuHomeFreeBSD
Differential D60007

libfetch: Limit response line length
ClosedPublic
Actions

Authored by des on Fri, Sep 25, 10:37 AM.
Tags
None
Referenced Files
F174769441: D60007.diff
Mon, Oct 5, 9:23 PM
F174761112: D60007.id188225.diff
Mon, Oct 5, 7:56 PM
F174687464: D60007.id188225.diff
Mon, Oct 5, 5:05 AM
F174674206: D60007.id188225.diff
Mon, Oct 5, 3:02 AM
F174671811: D60007.diff
Mon, Oct 5, 2:37 AM
F174666085: D60007.id.diff
Mon, Oct 5, 1:39 AM
Unknown Object (File)
Sun, Oct 4, 3:16 PM
Unknown Object (File)
Sun, Oct 4, 10:11 AM
View All 39 Files
Subscribers
imp

Details

Reviewers
markj
Commits
rG64ce9daab9ee: libfetch: Limit response line length
Summary

When reading an FTP or HTTP response, error out if we read 64 kB before
hitting a newline. Otherwise a runaway or malicious server could have
us spinning for quite a while allocating more and more memory before we
gave up or crashed.

MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 77301
Build 74184: arc lint + arc unit

Event Timeline

des created this revision.Fri, Sep 25, 10:37 AM
Herald added a subscriber: imp. · View Herald TranscriptFri, Sep 25, 10:37 AM
des requested review of this revision.Fri, Sep 25, 10:37 AM
Harbormaster completed remote builds in B77301: Diff 187650.Fri, Sep 25, 10:37 AM
des added a child revision: D60008: libfetch: Reject control characters in credentials.Fri, Sep 25, 10:37 AM
markj added inline comments.Mon, Sep 28, 9:50 PM
lib/libfetch/common.c
1474

I don't really follow: curr->pos is the absolute offset into the buffer. Shouldn't we be starting from 0 for each line?

des added inline comments.Tue, Sep 29, 12:03 PM
lib/libfetch/common.c
1474

conn->pos is initially the end of the previous line, so the check here (copy-pasted from below) is incorrect.

des updated this revision to Diff 187987.Tue, Sep 29, 12:26 PM

fix bounds check

Harbormaster completed remote builds in B77440: Diff 187987.Tue, Sep 29, 12:27 PM
markj accepted this revision.Wed, Sep 30, 2:29 PM

The commit log message should explain why.

This revision is now accepted and ready to land.Wed, Sep 30, 2:29 PM
des edited the summary of this revision. (Show Details)Wed, Sep 30, 4:34 PM
Closed by commit rG64ce9daab9ee: libfetch: Limit response line length (authored by des). · Explain WhyWed, Sep 30, 4:56 PM
This revision was automatically updated to reflect the committed changes.
des added a commit: rG64ce9daab9ee: libfetch: Limit response line length.

Revision Contents
Changeset List

PathSize
lib/
libfetch/
16 lines

Diff 187650

View Options

lib/libfetch/common.c

Loading...