Commit129d303

committed

Fix DOS attack from malicious pongs

A double channel close panic was possible if a peer sent back multiplepongs for every ping.If the second pong arrived before the ping goroutine deleted its channelfrom the map, the channel would be closed twice and so a panic wouldensue.This fixes that by having the read goroutine send on the pinggoroutine's channel rather than closing it.Reported via email by Tibor Kálmán@kalmantPlease update to the new release ASAP!

1 parente4c3b0f commit129d303Copy full SHA for 129d303

File tree

2 files changed

-2

lines changed

2 files changed

-2

lines changed

`‎conn_notjs.go‎`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -189,7 +189,7 @@ func (c *Conn) Ping(ctx context.Context) error {`
`189`	`189`	`}`
`190`	`190`
`191`	`191`	`func (c*Conn)ping(ctx context.Context,pstring)error {`
`192`		`-pong:=make(chanstruct{})`
	`192`	`+pong:=make(chanstruct{},1)`
`193`	`193`
`194`	`194`	`c.activePingsMu.Lock()`
`195`	`195`	`c.activePings[p]=pong`

`‎read.go‎`

Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -271,7 +271,10 @@ func (c *Conn) handleControl(ctx context.Context, h header) (err error) {`
`271`	`271`	`pong,ok:=c.activePings[string(b)]`
`272`	`272`	`c.activePingsMu.Unlock()`
`273`	`273`	`ifok {`
`274`		`-close(pong)`
	`274`	`+select {`
	`275`	`+casepong<-struct{}{}:`
	`276`	`+default:`
	`277`	`+}`
`275`	`278`	`}`
`276`	`279`	`returnnil`
`277`	`280`	`}`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit129d303

File tree

2 files changed

2 files changed

`‎conn_notjs.go‎`

`‎read.go‎`

0 commit comments