MirrorHub/construct
0
0
Fork 0
mirror of https://github.com/matrix-construct/construct synced 2024-11-29 10:12:39 +01:00
Code Issues Releases Wiki Activity

ircd::server: Limit recursion of chunk head parses.

Browse source
This commit is contained in:
Jason Volk 2018-04-25 20:50:24 -07:00
parent f6cafd54f3
commit 6add3e9952
2 changed files with 22 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/ircd/server/tag.h
View file

@ -61,9 +61,9 @@ struct ircd::server::tag
mutable_buffer make_read_head_buffer() const;
const_buffer read_chunk_dynamic_content(const const_buffer &, bool &done);
const_buffer read_chunk_dynamic_head(const const_buffer &, bool &done);
const_buffer read_chunk_dynamic_head(const const_buffer &, bool &done, const uint8_t = 0);
const_buffer read_chunk_content(const const_buffer &, bool &done);
const_buffer read_chunk_head(const const_buffer &, bool &done);
const_buffer read_chunk_head(const const_buffer &, bool &done, const uint8_t = 0);
const_buffer read_content(const const_buffer &, bool &done);
const_buffer read_head(const const_buffer &, bool &done, link &);

24
ircd/server.cc
View file

@ -2404,7 +2404,8 @@ ircd::server::tag::read_content(const const_buffer &buffer,
ircd::const_buffer
ircd::server::tag::read_chunk_head(const const_buffer &buffer,
bool &done)
bool &done,
const uint8_t recursion_level)
{
assert(request);
auto &req{*request};
@ -2509,7 +2510,14 @@ ircd::server::tag::read_chunk_head(const const_buffer &buffer,
if(done)
return overrun;
return read_chunk_head(overrun, done); // gobble gobbles
// Prevent stack overflow from lots of tiny chunks nagled together.
if(unlikely(recursion_level >= 32))
throw error
{
"Chunking recursion limit exceeded"
};
return read_chunk_head(overrun, done, recursion_level + 1);
}
ircd::const_buffer
@ -2580,7 +2588,8 @@ ircd::server::tag::read_chunk_content(const const_buffer &buffer,
ircd::const_buffer
ircd::server::tag::read_chunk_dynamic_head(const const_buffer &buffer,
bool &done)
bool &done,
const uint8_t recursion_level)
{
assert(request);
auto &req{*request};
@ -2681,7 +2690,14 @@ ircd::server::tag::read_chunk_dynamic_head(const const_buffer &buffer,
if(done)
return overrun;
return read_chunk_dynamic_head(overrun, done); // gobble gobbles
// Prevent stack overflow from lots of tiny chunks nagled together.
if(unlikely(recursion_level >= 32))
throw error
{
"Chunking recursion limit exceeded"
};
return read_chunk_dynamic_head(overrun, done, recursion_level + 1);
}
ircd::const_buffer