nats-io/nats-server

MaxPayload size is ignored

dgryski opened this issue · 3 comments

The max_payload configuration option is ignored when parsing.

This opens up two DoS vectors that cause crashes in gnatsd.

  1. PUB o 680444720440
    produces the following panic() output:
panic: runtime error: makeslice: cap out of range

goroutine 9 [running]:
github.com/nats-io/gnatsd/server.(*client).parse(0xc820132000, 0xc82013c000, 0x13, 0x8000, 0x0, 0x0)
    /home/dgryski/work/src/cvs/gocode/src/github.com/nats-io/gnatsd/server/parser.go:630 +0x291
github.com/nats-io/gnatsd/server.(*client).readLoop(0xc820132000)
    /home/dgryski/work/src/cvs/gocode/src/github.com/nats-io/gnatsd/server/client.go:155 +0x194
created by github.com/nats-io/gnatsd/server.(*client).initClient
    /home/dgryski/work/src/cvs/gocode/src/github.com/nats-io/gnatsd/server/client.go:133 +0x782

and 2) PUB 0 8000000000

produces an out-of-memory error on the same line

This issue was found by https://github.com/dvyukov/go-fuzz testing server/parser.go using the existing tests as a seed corpus.

Nice! I have some time this week, will address. Appreciate the effort.

This is fixed with this commit, 075529e