|
 |
8e12eea |
From a83dae404feac517695c23ff43ce1e116e2bfbe0 Mon Sep 17 00:00:00 2001
|
|
|
8e12eea |
From: Michael Catanzaro <mcatanzaro@gnome.org>
|
|
|
8e12eea |
Date: Wed, 9 Sep 2020 11:12:02 -0500
|
|
|
8e12eea |
Subject: [PATCH] Rewrite url::recvline to be nonrecursive
|
|
|
8e12eea |
|
|
|
8e12eea |
This function processes network input. It's semi-trusted, because the
|
|
|
8e12eea |
PAC ought to be trusted. But we still shouldn't allow it to control how
|
|
|
8e12eea |
far we recurse. A malicious PAC can cause us to overflow the stack by
|
|
|
8e12eea |
sending a sufficiently-long line without any '\n' character.
|
|
|
8e12eea |
|
|
|
8e12eea |
Also, this function failed to properly handle EINTR, so let's fix that
|
|
|
8e12eea |
too, for good measure.
|
|
|
8e12eea |
|
|
|
8e12eea |
Fixes #134
|
|
|
8e12eea |
---
|
|
|
8e12eea |
libproxy/url.cpp | 28 ++++++++++++++++++----------
|
|
|
8e12eea |
1 file changed, 18 insertions(+), 10 deletions(-)
|
|
|
8e12eea |
|
|
|
8e12eea |
diff --git a/libproxy/url.cpp b/libproxy/url.cpp
|
|
|
8e12eea |
index ee776b2..68d69cd 100644
|
|
|
8e12eea |
--- a/libproxy/url.cpp
|
|
|
8e12eea |
+++ b/libproxy/url.cpp
|
|
|
8e12eea |
@@ -388,16 +388,24 @@ string url::to_string() const {
|
|
|
8e12eea |
return m_orig;
|
|
|
8e12eea |
}
|
|
|
8e12eea |
|
|
|
8e12eea |
-static inline string recvline(int fd) {
|
|
|
8e12eea |
- // Read a character.
|
|
|
8e12eea |
- // If we don't get a character, return empty string.
|
|
|
8e12eea |
- // If we are at the end of the line, return empty string.
|
|
|
8e12eea |
- char c = '\0';
|
|
|
8e12eea |
-
|
|
|
8e12eea |
- if (recv(fd, &c, 1, 0) != 1 || c == '\n')
|
|
|
8e12eea |
- return "";
|
|
|
8e12eea |
-
|
|
|
8e12eea |
- return string(1, c) + recvline(fd);
|
|
|
8e12eea |
+static string recvline(int fd) {
|
|
|
8e12eea |
+ string line;
|
|
|
8e12eea |
+ int ret;
|
|
|
8e12eea |
+
|
|
|
8e12eea |
+ // Reserve arbitrary amount of space to avoid small memory reallocations.
|
|
|
8e12eea |
+ line.reserve(128);
|
|
|
8e12eea |
+
|
|
|
8e12eea |
+ do {
|
|
|
8e12eea |
+ char c;
|
|
|
8e12eea |
+ ret = recv(fd, &c, 1, 0);
|
|
|
8e12eea |
+ if (ret == 1) {
|
|
|
8e12eea |
+ if (c == '\n')
|
|
|
8e12eea |
+ return line;
|
|
|
8e12eea |
+ line += c;
|
|
|
8e12eea |
+ }
|
|
|
8e12eea |
+ } while (ret == 1 || (ret == -1 && errno == EINTR));
|
|
|
8e12eea |
+
|
|
|
8e12eea |
+ return line;
|
|
|
8e12eea |
}
|
|
|
8e12eea |
|
|
|
8e12eea |
char* url::get_pac() {
|