libnetconf
libnetconf copied to clipboard
Solve blocking read of incomplete RPCs (simple DoS)
Now the library return within timeout only when no data is available. However,
if an attacker sent only partial data (without the RPC-end-sequence), the
nc_session_rpc_recv() function will get stuck on read - denial of service.
To solve this problem, add a buffer of read but not yet processed data to every
session. If the data will turn out to be incomplete, return from
nc_session_recv_rpc() within the specified timeout and keep the contents of the
buffer for a later append of the rest of the message.
Original issue reported on code.google.com by [email protected] on 18 Dec 2014 at 10:07