Page MenuHomeFreeBSD
Differential D60007

libfetch: Limit response line length
ClosedPublic
Actions

Authored by des on Fri, Sep 25, 10:37 AM.
Tags
None
Referenced Files
F175069342: D60007.id.diff
Thu, Oct 8, 1:00 AM
F175019204: D60007.id187987.diff
Wed, Oct 7, 4:34 PM
Unknown Object (File)
Wed, Oct 7, 1:22 PM
Unknown Object (File)
Wed, Oct 7, 12:44 PM
Unknown Object (File)
Wed, Oct 7, 12:10 PM
Unknown Object (File)
Wed, Oct 7, 10:47 AM
Unknown Object (File)
Wed, Oct 7, 6:23 AM
Unknown Object (File)
Wed, Oct 7, 6:23 AM
View All 52 Files
Subscribers
imp

Details

Reviewers
markj
Commits
rG64ce9daab9ee: libfetch: Limit response line length
Summary

When reading an FTP or HTTP response, error out if we read 64 kB before
hitting a newline. Otherwise a runaway or malicious server could have
us spinning for quite a while allocating more and more memory before we
gave up or crashed.

MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 77440
Build 74323: arc lint + arc unit

Event Timeline

des created this revision.Fri, Sep 25, 10:37 AM
Herald added a subscriber: imp. · View Herald TranscriptFri, Sep 25, 10:37 AM
des requested review of this revision.Fri, Sep 25, 10:37 AM
Harbormaster completed remote builds in B77301: Diff 187650.Fri, Sep 25, 10:37 AM
des added a child revision: D60008: libfetch: Reject control characters in credentials.Fri, Sep 25, 10:37 AM
markj added inline comments.Mon, Sep 28, 9:50 PM
lib/libfetch/common.c
1474

I don't really follow: curr->pos is the absolute offset into the buffer. Shouldn't we be starting from 0 for each line?

des added inline comments.Tue, Sep 29, 12:03 PM
lib/libfetch/common.c
1474

conn->pos is initially the end of the previous line, so the check here (copy-pasted from below) is incorrect.

des updated this revision to Diff 187987.Tue, Sep 29, 12:26 PM

fix bounds check

Harbormaster completed remote builds in B77440: Diff 187987.Tue, Sep 29, 12:27 PM
markj accepted this revision.Wed, Sep 30, 2:29 PM

The commit log message should explain why.

This revision is now accepted and ready to land.Wed, Sep 30, 2:29 PM
des edited the summary of this revision. (Show Details)Wed, Sep 30, 4:34 PM
Closed by commit rG64ce9daab9ee: libfetch: Limit response line length (authored by des). · Explain WhyWed, Sep 30, 4:56 PM
This revision was automatically updated to reflect the committed changes.
des added a commit: rG64ce9daab9ee: libfetch: Limit response line length.

Revision Contents
Changeset List

PathSize
lib/
libfetch/
17 lines

Diff 187987

View Options

lib/libfetch/common.c

Loading...