Commitde018ed

committed

Fix DOS attack from malicous pongs

A double channel close panic was possible if a peer sent back multiplepongs for every ping.If the second pong arrived before the ping goroutine deleted its channelfrom the map, the channel would be closed twice and so a panic wouldensue.This fixes that by having the read goroutine send on the pinggoroutine's channel rather than closing it.Reported via email by Tibor Kálmán <kalmantibor2@gmail.com>Please update to the new release ASAP!

1 parente4c3b0f commitde018edCopy full SHA for de018ed

File tree

2 files changed

-2

lines changed

2 files changed

-2

lines changed

`‎conn_notjs.go‎`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -189,7 +189,7 @@ func (c *Conn) Ping(ctx context.Context) error {`
`189`	`189`	`}`
`190`	`190`
`191`	`191`	`func (c*Conn)ping(ctx context.Context,pstring)error {`
`192`		`-pong:=make(chanstruct{})`
	`192`	`+pong:=make(chanstruct{},1)`
`193`	`193`
`194`	`194`	`c.activePingsMu.Lock()`
`195`	`195`	`c.activePings[p]=pong`

`‎read.go‎`

Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -271,7 +271,10 @@ func (c *Conn) handleControl(ctx context.Context, h header) (err error) {`
`271`	`271`	`pong,ok:=c.activePings[string(b)]`
`272`	`272`	`c.activePingsMu.Unlock()`
`273`	`273`	`ifok {`
`274`		`-close(pong)`
	`274`	`+select {`
	`275`	`+casepong<-struct{}{}:`
	`276`	`+default:`
	`277`	`+}`
`275`	`278`	`}`
`276`	`279`	`returnnil`
`277`	`280`	`}`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitde018ed

File tree

2 files changed

2 files changed

`‎conn_notjs.go‎`

`‎read.go‎`

0 commit comments