kore

commit 1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b
parent d9ef29a8d8c8e7e53c9da90b7d41aabfd5ef43cf
Author: Joris Vink <joris@sanctorum.se>
Date:   Wed,  2 Sep 2026 23:11:07 +0200

http: Make sure nb->s_off - len doesn't underflow.

In certain scenarios it is possible for this to underflow
leading to a bypass of the http_header_max check.

When this happens Kore will read data from the wire into its
http_body buffer until its default timeout of 60 seconds occurs,
opening a window for a potential DoS by memory exhaustion.

At no point does it write out-of-bounds.

Reported by Tristan <TristanInSec@gmail.com>

Diffstat:
src/http.c
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/http.c b/src/http.c
@@ -930,7 +930,8 @@ http_header_recv(struct netbuf *nb)
 			return (KORE_RESULT_OK);
 		}
 
-		if (req->content_length > http_body_max) {
+		if (((nb->s_off - len) > req->content_length) ||
+		    (req->content_length > http_body_max)) {
 			req->flags |= HTTP_REQUEST_DELETE;
 			http_error_response(req->owner,
 			    HTTP_STATUS_REQUEST_ENTITY_TOO_LARGE);