CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 14:49:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix infinite loop with memory consumption

Browse source
This commit is contained in:
dmiller 2026-07-30 21:29:07 +00:00
parent a5b8e61051
commit 7a2ee5c00e
2 changed files with 22 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

3
CHANGELOG
View file

@ -1,5 +1,8 @@
#Nmap Changelog ($Id$); -*-text-*-
o Fixed a memory-consumption hang in Ncat's HTTP proxy code that affected both
connect and listen modes, reported by kumama_nui.
o Patched our included libssh2 source with upstream fixes for CVE-2025-15661,
CVE-2026-7598, CVE-2026-55199, CVE-2026-55200, CVE-2026-58050, and
CVE-2026-58051. The version number has been annotated as 1.11.1_NMAP1

32
ncat/http.c
View file

@ -117,6 +117,7 @@ char *socket_buffer_readline(struct socket_buffer *buf, size_t *n, size_t maxlen
char *line;
char *newline;
size_t count;
const char *p;
line = NULL;
*n = 0;
@ -150,6 +151,17 @@ char *socket_buffer_readline(struct socket_buffer *buf, size_t *n, size_t maxlen
*n += count;
return NULL;
}
/* Check for disallowed characters */
p = buf->p + count - 2;
if (p >= buf->p && *p == '\r')
--p;
while (p >= buf->p) {
if (is_ctl_char(*p) && *p != '\t') {
free(line);
return NULL;
}
--p;
}
line = (char *) safe_realloc(line, *n + count + 1);
memcpy(line + *n, buf->p, count);
@ -975,22 +987,16 @@ int http_parse_header(struct http_header **result, const char *header)
/* Copy the header field value until we hit a CRLF. */
p = q + 1;
p = skip_lws(p);
for (;;) {
q = p;
while (*q != '\0' && !is_space_char(*q) && !is_crlf(q)) {
/* Section 2.2 of RFC 2616 disallows control characters. */
if (iscntrl((int) (unsigned char) *q)) {
http_header_node_free(node);
return 400;
}
q++;
while (*p != '\0' && !is_crlf(p)) {
if (value_len > 0) {
/* Replace LWS with a single space. */
strbuf_append_str(&node->value, &value_len, &value_offset, " ");
}
q = strpbrk(p, " \t\r\n");
if (!q)
q = p + strlen(p);
strbuf_append(&node->value, &value_len, &value_offset, p, q - p);
p = skip_lws(q);
if (is_crlf(p))
break;
/* Replace LWS with a single space. */
strbuf_append_str(&node->value, &value_len, &value_offset, " ");
}
*prev = node;
prev = &node->next;