[
https://issues.apache.org/jira/browse/HTTPCORE-491?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16182612#comment-16182612
]
ASF GitHub Bot commented on HTTPCORE-491:
-----------------------------------------
GitHub user mheemskerk opened a pull request:
https://github.com/apache/httpcomponents-core/pull/52
HTTPCORE-491 make basicasyncresponseconsumer paranoid
`BasicAsyncRequestConsumer` and `BasicAsyncResponseConsumer` used to
blindly pre-allocate a buffer of `Content-Length`. If the request / response
is crafted to have a very large `Content-Length` header, this can result in
`OutOfMemoryError`s.
This limits the initial buffer size to 256kb, while still allowing the
buffer to grow if a larger message is read.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/mheemskerk/httpcomponents-core
HTTPCORE-491-make-basicasyncresponseconsumer-paranoid
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/httpcomponents-core/pull/52.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #52
----
commit 273c1817ebd4ab40e29c05365e488cdd76a4186b
Author: Michael Heemskerk <[email protected]>
Date: 2017-09-27T14:00:30Z
HTTPCORE-491 Make BasicAsyncRequest|ResponseConsumer more paranoid
BasicAsyncRequestConsumer and BasicAsyncResponseConsumer used to
blindly pre-allocate a buffer of Content-Length. If the request / response
is crafted to have a very large Content-Length header, this can result in
OutOfMemoryErrors.
This limits the initial buffer size to 256kb, while still allowing the
buffer to grow if a larger message is read.
----
> BasicAsyncResponseConsumer can easily be tricked into triggering an OOME
> ------------------------------------------------------------------------
>
> Key: HTTPCORE-491
> URL: https://issues.apache.org/jira/browse/HTTPCORE-491
> Project: HttpComponents HttpCore
> Issue Type: Bug
> Components: HttpCore NIO
> Affects Versions: 4.4.7
> Reporter: Michael Heemskerk
> Fix For: 4.4.8
>
>
> When using {{BasicAsyncResponseConsumer}} to consume a response, the consumer
> initializes its {{SimpleInputBuffer}} with the value reported on the
> response's {{Content-Length}} header.
> It's easy to spoof a response with a very large (but smaller than
> Integer.MAX_VALUE) {{Content-Length}} header and have the client pre-allocate
> a massive buffer, triggering an OOME.
> Since {{SimpleInputBuffer}} already expands-on-demand, it would be trivial to
> cap the initial buffer size to some reasonable limit (256k or even 1M)
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
