commit ce3101d0169f6a0f483a72a8cf18d7da8359b6d5
Author: Cecylia Bocovich <[email protected]>
Date: Fri May 10 15:36:04 2019 -0400
Guard against large reads
This is a fix for #26348
---
broker/broker.go | 6 +++---
client/lib/rendezvous.go | 2 +-
proxy-go/snowflake.go | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/broker/broker.go b/broker/broker.go
index ae27a47..a0ef38a 100644
--- a/broker/broker.go
+++ b/broker/broker.go
@@ -136,7 +136,7 @@ For snowflake proxies to request a client from the Broker.
*/
func proxyPolls(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) {
id := r.Header.Get("X-Session-ID")
- body, err := ioutil.ReadAll(r.Body)
+ body, err := ioutil.ReadAll(http.MaxBytesReader(w, r.Body, 100000))
if nil != err {
log.Println("Invalid data.")
w.WriteHeader(http.StatusBadRequest)
@@ -166,7 +166,7 @@ the HTTP response back to the client.
*/
func clientOffers(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) {
startTime := time.Now()
- offer, err := ioutil.ReadAll(r.Body)
+ offer, err := ioutil.ReadAll(http.MaxBytesReader(w, r.Body, 100000))
if nil != err {
log.Println("Invalid data.")
w.WriteHeader(http.StatusBadRequest)
@@ -213,7 +213,7 @@ func proxyAnswers(ctx *BrokerContext, w
http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusGone)
return
}
- body, err := ioutil.ReadAll(r.Body)
+ body, err := ioutil.ReadAll(http.MaxBytesReader(w, r.Body, 100000))
if nil != err || nil == body || len(body) <= 0 {
log.Println("Invalid data.")
w.WriteHeader(http.StatusBadRequest)
diff --git a/client/lib/rendezvous.go b/client/lib/rendezvous.go
index d04b0b1..e53c51e 100644
--- a/client/lib/rendezvous.go
+++ b/client/lib/rendezvous.go
@@ -91,7 +91,7 @@ func (bc *BrokerChannel) Negotiate(offer
*webrtc.SessionDescription) (
switch resp.StatusCode {
case http.StatusOK:
- body, err := ioutil.ReadAll(resp.Body)
+ body, err := ioutil.ReadAll(http.MaxBytesReader(nil, resp.Body,
100000))
if nil != err {
return nil, err
}
diff --git a/proxy-go/snowflake.go b/proxy-go/snowflake.go
index 858320b..ebab790 100644
--- a/proxy-go/snowflake.go
+++ b/proxy-go/snowflake.go
@@ -162,7 +162,7 @@ func pollOffer(sid string) *webrtc.SessionDescription {
if resp.StatusCode != http.StatusOK {
log.Printf("broker returns: %d",
resp.StatusCode)
} else {
- body, err := ioutil.ReadAll(resp.Body)
+ body, err :=
ioutil.ReadAll(http.MaxBytesReader(nil, resp.Body, 100000))
if err != nil {
log.Printf("error reading broker
response: %s", err)
} else {
_______________________________________________
tor-commits mailing list
[email protected]
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits
