Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix handling of HTTP body length

Browse source 
Partial content bytes range length value and content length value
should not be stored in the same variable. An attacker could override
a given Content-Length or Content-Range with a smaller value to
evade HTTP content.
This commit is contained in:
jbencteux 2018-04-13 14:23:14 +02:00 • committed by Jon Siwek
parent 2a01c70837
commit c0cc4ef192
2 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/analyzer/protocol/http/HTTP.cc
View file

@ -364,7 +364,19 @@ void HTTP_Entity::SubmitHeader(mime::MIME_Header* h)
{ {
int64_t n; int64_t n;
if ( atoi_n(vt.length, vt.data, 0, 10, n) ) if ( atoi_n(vt.length, vt.data, 0, 10, n) )
{
content_length = n; content_length = n;
if ( is_partial_content && range_length != content_length )
{
// Possible evasion attempt.
http_message->Weird("HTTP_range_not_matching_len");
// Take the maximum of both lengths to avoid evasions.
if ( range_length > content_length )
content_length = range_length;
}
}
else else
content_length = 0; content_length = 0;
} }
@ -432,7 +444,16 @@ void HTTP_Entity::SubmitHeader(mime::MIME_Header* h)
is_partial_content = true; is_partial_content = true;
offset = f; offset = f;
content_length = len; range_length = len;
if ( content_length != 0 && content_length != range_length )
{
// Possible evasion attempt.
http_message->Weird("HTTP_range_not_matching_len");
// Take the maximum of both lengths to avoid evasions.
if ( range_length > content_length )
content_length = range_length;
}
} }
else else
{ {

1
src/analyzer/protocol/http/HTTP.h
View file

@ -55,6 +55,7 @@ protected:
HTTP_Message* http_message; HTTP_Message* http_message;
int chunked_transfer_state; int chunked_transfer_state;
int64_t content_length; int64_t content_length;
int64_t range_length;
int64_t expect_data_length; int64_t expect_data_length;
int expect_body; int expect_body;
int64_t body_length; int64_t body_length;