Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve handling of expanding HTTP header values #1536

Closed
wants to merge 2 commits into from
Closed

Improve handling of expanding HTTP header values #1536

wants to merge 2 commits into from

Commits on Oct 23, 2023

  1. Improve handling of expanding HTTP header values 

    Squid manipulations often increase HTTP header value length compared to
the corresponding raw value received by Squid. Raw header length is
checked against request_header_max_size and reply_header_max_size that
default to 64KB, making the raw value safe to store in a String object
(by default). However, when the increased length of a manipulated value
exceeds String class limits, Squid leaks memory, asserts, or possibly
stalls affected transactions. The long-term fix for this problem is a
complete String elimination from Squid sources, but that takes time.

Known manipulations may effectively concatenate headers and/or increase
header value length by 50%. This workaround makes such known increases
safe by essentially tripling String class limits:

    (64KB + 64KB) * 150% = 3 * 64KB

This bug was discovered and detailed by Joshua Rogers at
https://megamansec.github.io/Squid-Security-Audit/response-memleaks.html
where it was filed as "Memory Leak in HTTP Response Parsing".
    @rousskov
    rousskov committed Oct 23, 2023
    Configuration menu
    Copy the full SHA
    85359f2 View commit details
    Browse the repository at this point in the history

  2. Warn admins about unsafe reply/request_header_max_size increases

    @rousskov
    rousskov committed Oct 23, 2023
    Configuration menu
    Copy the full SHA
    ffb44d2 View commit details
    Browse the repository at this point in the history