[Bug 8426] New: Buffer overflow in httpd

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=8426

           Summary: Buffer overflow in httpd
           Product: Busybox
           Version: unspecified
          Platform: PC
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Networking
        AssignedTo: unassigned at busybox.net
        ReportedBy: inguin at gmx.de
                CC: busybox-cvs at busybox.net
   Estimated Hours: 0.0


There is a bug in Busybox httpd that allows an attacker to provoke a heap
buffer overflow: When a client requests a URL that points to a directory and
omits the trailing slash, the httpd will generate a 302 Found response. The
response contains a Location: header that copies the client-provided URL path
and query string. There is no length check when writing those strings into
iobuf (httpd.c:970). The data originally comes from iobuf, but together with
the remaining header lines the total response size can exceed the buffer size.

Steps to reproduce:

mkdir test
python -c 'print("get /test?" + ("x" * 8192))' | valgrind ./busybox httpd -i -h
.

-- 
Configure bugmail: https://bugs.busybox.net/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.