Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 19 Jul 2021 14:18:05 -0400
From: Jeffrey Walton <>
Subject: Re: Polipo: denial-of-service using range

> I found a vulnerability in the Polipo [1],
> lightweight, caching web proxy.
> ...
> Polipo doesn't ignore/reject the malformed header. Instead, it has
> an assertion:
>     server.c:1473: assert(from >= 0 && (to < 0 || to > from));
> So, a malformed Range header ("Range: bytes=3-2" for example) will
> cause an assertion failed.  This error handling allows an attacker
> to cause a denial of service.

I would be interested to know what happens when NDEBUG is defined so
the assert goes away. Does the server crash, does it lead to memory
corruption, an information leakage (like a private key), or something


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.