mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 02:28:21 +00:00
MIME: Cap nested MIME analysis depth to 100
OSS-Fuzz managed to produce a MIME multipart message construction with thousands of nested entities (or that's what Zeek makes out of it anyhow). Prevent such deep analysis by capping at a nesting depth of 100, preventing unnecessary resource usage. A new weird named exceeded_mime_max_depth is reported when this limit is reached. This change reduces the runtime of the OSS-Fuzz reproducer from ~45 seconds to ~2.5 seconds. The test PCAP was produced from a Python script using the email package and sending the rendered version via POST to a HTTP server. Closes #208 (cherry picked from commit 4e5849fe82c6097df5d25cd1a74d69ab4fa50f46)
This commit is contained in:
parent
37bc6517f0
commit
5659cf18f8
12 changed files with 72 additions and 0 deletions
|
@ -2720,6 +2720,16 @@ export {
|
|||
} # end export
|
||||
|
||||
|
||||
module MIME;
|
||||
export {
|
||||
## Stop analysis of nested multipart MIME entities if this depth is
|
||||
## reached. Setting this value to 0 removes the limit.
|
||||
const max_depth = 100 &redef;
|
||||
|
||||
} # end export
|
||||
|
||||
|
||||
|
||||
module MOUNT3;
|
||||
export {
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue