]> git.ipfire.org Git - thirdparty/asterisk.git/commit
AST-2018-007: iostreams potential DoS when client connection closed prematurely
authorSean Bright <sean.bright@gmail.com>
Mon, 16 Apr 2018 19:13:58 +0000 (15:13 -0400)
committerKevin Harwell <kharwell@digium.com>
Mon, 11 Jun 2018 15:28:43 +0000 (09:28 -0600)
commitb649682caa09a73f0e7d08fc6b96d5c208142b99
tree58acc7504617afb45c91576189fe176c35a88d2b
parent9f2eb170054bd97b3a29f3ce3bdae5bac02fd052
AST-2018-007: iostreams potential DoS when client connection closed prematurely

Before Asterisk sends an HTTP response (at least in the case of errors),
it attempts to read & discard the content of the request. If the client
lies about the Content-Length, or the connection is closed from the
client side before "Content-Length" bytes are sent, the request handling
thread will busy loop.

ASTERISK-27807

Change-Id: I945c5fc888ed92be625b8c35039fc6d2aa89c762
main/iostream.c