From 12e424f241b29ef26ad2a3a70740d8b320e9e85a Mon Sep 17 00:00:00 2001
From: Kurt Pattyn <pattyn.kurt@gmail.com>
Date: Sun, 6 Sep 2015 15:30:03 +0200
Subject: Fix DoS vulnerability

Add checks on maximum header line length and on the maximum number
of header lines.

Task-number: QTBUG-48123
Change-Id: I65dbeb53af7aa0dfa137ce31fc2549940559314e
Reviewed-by: Richard J. Moore <rich@kde.org>
---
 src/websockets/qwebsockethandshakerequest.cpp | 56 +++++++++++++++++++++++----
 src/websockets/qwebsockethandshakerequest_p.h |  2 +-
 src/websockets/qwebsocketserver_p.cpp         |  8 +++-
 3 files changed, 57 insertions(+), 9 deletions(-)

(limited to 'src')

diff --git a/src/websockets/qwebsockethandshakerequest.cpp b/src/websockets/qwebsockethandshakerequest.cpp
index 528cb32..e2cbaef 100644
--- a/src/websockets/qwebsockethandshakerequest.cpp
+++ b/src/websockets/qwebsockethandshakerequest.cpp
@@ -183,18 +183,49 @@ QUrl QWebSocketHandshakeRequest::requestUrl() const
 }
 
 /*!
+    Reads a line of text from the given textstream (terminated by CR/LF).
+    If an empty line was detected, an empty string is returned.
+    When an error occurs, a null string is returned.
     \internal
  */
-void QWebSocketHandshakeRequest::readHandshake(QTextStream &textStream)
+static QString readLine(QTextStream &stream, int maxHeaderLineLength)
+{
+    QString line;
+    char c;
+    while (!stream.atEnd()) {
+        stream >> c;
+        if (stream.status() != QTextStream::Ok)
+            return QString();
+        if (c == char('\r')) {
+            //eat the \n character
+            stream >> c;
+            line.append(QStringLiteral(""));
+            break;
+        } else {
+            line.append(QChar::fromLatin1(c));
+            if (line.length() > maxHeaderLineLength)
+                return QString();
+        }
+    }
+    return line;
+}
+
+/*!
+    \internal
+ */
+void QWebSocketHandshakeRequest::readHandshake(QTextStream &textStream, int maxHeaderLineLength,
+                                               int maxHeaders)
 {
-    m_isValid = false;
     clear();
     if (Q_UNLIKELY(textStream.status() != QTextStream::Ok))
         return;
-    const QString requestLine = textStream.readLine();
+    const QString requestLine = readLine(textStream, maxHeaderLineLength);
+    if (requestLine.isNull()) {
+        clear();
+        return;
+    }
     const QStringList tokens = requestLine.split(' ', QString::SkipEmptyParts);
     if (Q_UNLIKELY(tokens.length() < 3)) {
-        m_isValid = false;
         clear();
         return;
     }
@@ -206,10 +237,13 @@ void QWebSocketHandshakeRequest::readHandshake(QTextStream &textStream)
 
     if (Q_UNLIKELY(!conversionOk)) {
         clear();
-        m_isValid = false;
         return;
     }
-    QString headerLine = textStream.readLine();
+    QString headerLine = readLine(textStream, maxHeaderLineLength);
+    if (headerLine.isNull()) {
+        clear();
+        return;
+    }
     m_headers.clear();
     while (!headerLine.isEmpty()) {
         const QStringList headerField = headerLine.split(QStringLiteral(": "),
@@ -219,7 +253,15 @@ void QWebSocketHandshakeRequest::readHandshake(QTextStream &textStream)
             return;
         }
         m_headers.insertMulti(headerField.at(0).toLower(), headerField.at(1));
-        headerLine = textStream.readLine();
+        if (m_headers.size() > maxHeaders) {
+            clear();
+            return;
+        }
+        headerLine = readLine(textStream, maxHeaderLineLength);
+        if (headerLine.isNull()) {
+            clear();
+            return;
+        }
     }
 
     m_requestUrl = QUrl::fromEncoded(resourceName.toLatin1());
diff --git a/src/websockets/qwebsockethandshakerequest_p.h b/src/websockets/qwebsockethandshakerequest_p.h
index ad2a249..6ad5381 100644
--- a/src/websockets/qwebsockethandshakerequest_p.h
+++ b/src/websockets/qwebsockethandshakerequest_p.h
@@ -78,7 +78,7 @@ public:
     QString resourceName() const;
     QString host() const;
 
-    void readHandshake(QTextStream &textStream);
+    void readHandshake(QTextStream &textStream, int maxHeaderLineLength, int maxHeaders);
 
 private:
 
diff --git a/src/websockets/qwebsocketserver_p.cpp b/src/websockets/qwebsocketserver_p.cpp
index bc23674..d1750ce 100644
--- a/src/websockets/qwebsocketserver_p.cpp
+++ b/src/websockets/qwebsocketserver_p.cpp
@@ -49,6 +49,12 @@
 
 QT_BEGIN_NAMESPACE
 
+//both constants are taken from the default settings of Apache
+//see: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize and
+//http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfields
+const int MAX_HEADERLINE_LENGTH = 8 * 1024; //maximum length of a http request header line
+const int MAX_HEADERLINES = 100;            //maximum number of http request header lines
+
 /*!
     \internal
  */
@@ -431,7 +437,7 @@ void QWebSocketServerPrivate::handshakeReceived()
 
     QWebSocketHandshakeRequest request(pTcpSocket->peerPort(), isSecure);
     QTextStream textStream(pTcpSocket);
-    request.readHandshake(textStream);
+    request.readHandshake(textStream, MAX_HEADERLINE_LENGTH, MAX_HEADERLINES);
 
     if (request.isValid()) {
         QWebSocketCorsAuthenticator corsAuthenticator(request.origin());
-- 
cgit v1.2.1