http3: limit frame size to prevent unbounded memory allocation#250
http3: limit frame size to prevent unbounded memory allocation#250BiswajeetRay7 wants to merge 1 commit into
Conversation
|
This PR (HEAD: 17b15fd) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/net/+/788863. Important tips:
|
Without a size limit on incoming HTTP/3 frames, a malicious client could send an arbitrarily large HEADERS frame causing unbounded memory allocation and an OOM crash. This adds a maxHeaderSectionSize constant (10MB) matching the default MaxHeaderListSize used by the HTTP/2 implementation. Fixes potential DoS via oversized HEADERS frames. Fixes golang/go#79922
17b15fd to
00fb81d
Compare
|
Message from Gopher Robot: Patch Set 1: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/788863. |
|
This PR (HEAD: 00fb81d) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/net/+/788863. Important tips:
|
|
Message from Gopher Robot: Patch Set 1: Congratulations on opening your first change. Thank you for your contribution! Next steps: Most changes in the Go project go through a few rounds of revision. This can be During May-July and Nov-Jan the Go project is in a code freeze, during which Please don’t reply on this GitHub thread. Visit golang.org/cl/788863. |
|
Message from Biswajeet Ray: Patch Set 1: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/788863. |
Without a size limit on incoming HTTP/3 frames, a malicious client
could send an arbitrarily large HEADERS frame causing unbounded
memory allocation and an OOM crash.
This adds a maxHeaderSectionSize constant (10MB) matching the
default MaxHeaderListSize used by the HTTP/2 implementation.
Fixes potential DoS via oversized HEADERS frames.
Fixes golang/go#79922