lisdude/toaststunt

Network Buffer Overflows Closes TLS Connections

lisdude opened this issue · 0 comments

The problem here is that ssl_write() wants the exact same arguments as the first time it was run after SSL_ERROR_WANT_WRITE. Unfortunately, when MAX_QUEUED_OUTPUT is exceeded, that output is unceremoniously tossed out and we can't give it back to ssl_write(). This results in SSL_ERROR_SSL (ssl3_write_pending:bad write retry) and the connection is closed.

Right now the best worst idea I have is to store h->output_head in push_output() when it encounters SSL_ERROR_WANT_WRITE. The next invocation will prune the output based on MAX_QUEUED_OUTPUT, as expected, but we'll still have sufficient information for ssl_write() to continue. After we repeat whatever was in the original output_head, we can clear that and continue as normal. I think this will work, but it seems a bit workaroundy.

Any smarter ideas?

You can reproduce this by connecting to ToastCore via TLS and evaling something like: ;for x in [1..10000] me:tell($wiz_utils:random_password(30)); yin(); endfor