Changeset 45a71c9d in rtems

Timestamp:

02/08/06 16:15:09 (17 years ago)

Author:

Joel Sherrill <joel.sherrill@…>

Children:

c9c835c

Parents:

23e7d308

Message:

2006-02-08 Thomas Rauscher <trauscher@…>

PR 890/networking

• rtems_webserver/webs.c: The webservers enters an infinite loop when a POST request with less data than indicated in the Content-Length header is received. It also consumes additional heap memory and a file descriptor for each invalid POST.

Location:

c/src/libnetworking

Files:

• ChangeLog (modified) (1 diff)
• rtems_webserver/webs.c (modified) (1 diff)

c/src/libnetworking/ChangeLog

@@ +1 @@
+2006-02-08      Thomas Rauscher  <trauscher@loytec.com>
+
+        PR 890/networking
+        * rtems_webserver/webs.c: The webservers enters an infinite loop when a
+        POST request with less data than indicated in the Content-Length
+        header is received. It also consumes additional heap memory and a
+        file descriptor for each invalid POST.
+
 2005-05-20      Sergei Organov  <osv@topconrd.ru>
 

c/src/libnetworking/rtems_webserver/webs.c

@@ -566 +566 @@
 
                 }  else if (nbytes == 0) {                              /* EOF or No data available */
+                        /* Bugfix for POST DoS attack with invalid content length */
+                        if (socketEof(wp->sid)) {
+                                websDone(wp, 0);
+                        }
+                        /* End of bugfix */
                         return -1;