[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH8yC8nDTF9-aBtuKG+81rEYmf4QigMfwB3EEw8hwYiGHP+AeQ@mail.gmail.com>
Date: Mon, 19 Jul 2021 14:18:05 -0400
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Polipo: denial-of-service using range
> I found a vulnerability in the Polipo [1],
> lightweight, caching web proxy.
> ...
>
> Polipo doesn't ignore/reject the malformed header. Instead, it has
> an assertion:
>
> server.c:1473: assert(from >= 0 && (to < 0 || to > from));
>
> So, a malformed Range header ("Range: bytes=3-2" for example) will
> cause an assertion failed. This error handling allows an attacker
> to cause a denial of service.
I would be interested to know what happens when NDEBUG is defined so
the assert goes away. Does the server crash, does it lead to memory
corruption, an information leakage (like a private key), or something
else?
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
