diff options
| author | Paul Buetow <paul@buetow.org> | 2026-06-30 13:54:36 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-06-30 13:54:36 +0300 |
| commit | fed8e7b6d78c39b8a53af6f6c98188bc4d3c97c9 (patch) | |
| tree | 7a8bf153697b9fdff6b8de7576c8367350f0ed44 /yhttpd/src/thrd | |
| parent | 4f8e26db8f645e8d50a9a9b31e5935c6967de55d (diff) | |
Fix READSOCK=2048 request cap (oversized requests spin/hang)
src/glob.h: READSOCK 2048 -> 16384 so normal chat requests (incl. reverse
proxy X-Forwarded-* headers + a message body) fit. Previously requests
>2KB couldn't be fully read; for a POST whose Content-Length exceeded the
buffer the completeness check re-armed the read event forever (per-
connection spin/hang, no crash).
src/sock/sock.cpp handle_client_read: guard both the headers-incomplete
and body-incomplete re-arms with (i_buf_len < READSOCK). If the buffer is
already full the request can never complete (oversized): drop it without
re-arming instead of spinning. Deleting the context inside the read
callback corrupts libevent (verified: heap corruption / SIGSEGV, tried
both del_event+delete and event_del+delete and a 413-via-write-event), so
the oversized request's fd/context is intentionally leaked for that one
abusive request rather than crashing the server. The leak is a known
limitation (filed as a follow-up: defer reaping via the timer so the fd
is reclaimed without deleting inside the read callback).
Verified: oversized headers (17KB, no terminator) and oversized POST body
(20KB) no longer crash or spin the server (0 restarts); an 8KB POST login
now returns 200 (didn't fit in the old 2KB buffer); normal login + multi-
user chat still work. Independent review: APPROVE-WITH-NITS; the
headers-incomplete spin guard was added per the review.
Diffstat (limited to 'yhttpd/src/thrd')
0 files changed, 0 insertions, 0 deletions
