Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Solve blocking read of incomplete RPCs (simple DoS) #51

Open
GoogleCodeExporter opened this issue Apr 14, 2015 · 0 comments
Open

Solve blocking read of incomplete RPCs (simple DoS) #51

GoogleCodeExporter opened this issue Apr 14, 2015 · 0 comments

Comments

@GoogleCodeExporter
Copy link

Now the library return within timeout only when no data is available. However, 
if an attacker sent only partial data (without the RPC-end-sequence), the 
nc_session_rpc_recv() function will get stuck on read - denial of service.

To solve this problem, add a buffer of read but not yet processed data to every 
session. If the data will turn out to be incomplete, return from 
nc_session_recv_rpc() within the specified timeout and keep the contents of the 
buffer for a later append of the rest of the message.

Original issue reported on code.google.com by mv6...@gmail.com on 18 Dec 2014 at 10:07

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant