net/http, x/net/proxy: Panic triggerable by SOCKS5 server

[special]

x/net/proxy's SOCKS5 implementation has a logic error that allows the SOCKS server to trigger a client-side panic:

From https://github.com/golang/net/blob/master/proxy/socks5.go and reduced for clarity:

	bytesToDiscard := 0
	switch buf[3] {
	case socks5Domain:
		_, err := io.ReadFull(conn, buf[:1])
		bytesToDiscard = int(buf[0])
	}

	if cap(buf) < bytesToDiscard {
		buf = make([]byte, bytesToDiscard)
	} else {
		buf = buf[:bytesToDiscard]
	}
	if _, err := io.ReadFull(conn, buf); err != nil {
		return errors.New("proxy: failed to read address from SOCKS5 proxy at " + s.addr + ": " + err.Error())
	}

	// Also need to discard the port number
	if _, err := io.ReadFull(conn, buf[:2]); err != nil {

The length of buf is determined by the server here and may be less than 2.

[bradfitz]

/cc @mikioh

[mikioh]

See https://go-review.googlesource.com/c/38278; it also fixes this issue.

[mikioh]

Not sure why packages in x/net repo need to have Go1.10 label, though.

[bradfitz]

@mikioh, it gets a Go1.x label if it's vendored into std.

[mikioh]

@special,

I agree that it's a bug that io.ReadFull is not cancelable in the existing SOCKS client implementation. Although, I'm still not sure how the corrupted message from a SOCKS server makes a SOCKS client crash. Can you please explain the detail?

@bradfitz,

Ah, I forgot it.

[special]

@mikioh

If the server sends socks5Domain and a length (bytesToDiscard) of < 2, buf is resized to that length. The slice buf[:2] when reading the port will then be invalid.

It looks like the code at https://go-review.googlesource.com/c/38278 does avoid this issue.

[mikioh]

@special,

Thanks for the information. Looks like it's better to add a few test cases on corrupted TLV-style data into CL 38378.

[gopherbot]

Change https://golang.org/cl/38278 mentions this issue: internal/{socks,sockstest}: new packages

[gopherbot]

Change https://golang.org/cl/41031 mentions this issue: net/http: replace SOCKS client implementation

[mikioh]

@rsc marked CL 38278 and 41931 with Go 1.11.