Navigation Menu

Skip to content

Commit

Permalink
Limit identity packets to 8KiB
Browse files Browse the repository at this point in the history
Healthy identity packages shouldn't be that big and we don't want to
allow systems around us to send us ever humongous packages that will
just leave us without any memory.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.
  • Loading branch information
aleixpol authored and albertvaka committed Oct 2, 2020
1 parent 7e47d04 commit 4fbd01a
Showing 1 changed file with 8 additions and 0 deletions.
8 changes: 8 additions & 0 deletions core/backends/lan/lanlinkprovider.cpp
Expand Up @@ -399,6 +399,14 @@ void LanLinkProvider::newConnection()
void LanLinkProvider::dataReceived()
{
QSslSocket* socket = qobject_cast<QSslSocket*>(sender());
//the size here is arbitrary and is now at 8192 bytes. It needs to be considerably long as it includes the capabilities but there needs to be a limit
//Tested between my systems and I get around 2000 per identity package.
if (socket->bytesAvailable() > 8192) {
qCWarning(KDECONNECT_CORE) << "LanLinkProvider/newConnection: Suspiciously long identity package received. Closing connection." << socket->peerAddress() << socket->bytesAvailable();
socket->disconnectFromHost();
return;
}

#if QT_VERSION < QT_VERSION_CHECK(5,7,0)
if (!socket->canReadLine())
return;
Expand Down

0 comments on commit 4fbd01a

Please sign in to comment.