mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-13 19:48:16 +04:00
Hauke Mehrtens
80de19ea3b
f6c2fcfa539d client: cap cumulative header count and bytes per request 4f307a2156f3 client: verify chunk data is followed by CRLF before resyncing 628a073fef44 listen: set IP_FREEBIND so binding to a not-yet-present address works 0910904b75a3 client: reject empty chunk size lines in chunked transfer parsing 893fed8577d7 client: use strict chunk size parsing to fix issue #3 8867514f51fa client: fix parse_chunksize() return type and stale comment daa5078b959b client: reject invalid header names to prevent request smuggling 69f9cabd0d7d http: use chartypes table consistently, drop ctype.h 003cd188b8f9 http: further consolidate character classification and header parsing f682ccabee9e client: parse and discard chunked trailer sections, use enum chunked_state e76736e5676f ubus: guard params type in uh_ubus_send_request() 42e30caa704e ubus: set d->free unconditionally to fix url_path leak d6205aad6176 client: move unread-body guard into uh_request_done() 3c48b9e17d20 ubus: release client refcount on successful /ubus/subscribe d0b89eb7c70b utils: strip trailing whitespace from header field-values 067466662368 file: dereference symlinks when looking up MIME type c54ba119cf54 lua, ucode: use buffered stdio for script output 60f64bec40c8 tls: add SNI-based redirect support This closes five published security advisories, three of them rated high: an unauthenticated header-accumulation memory-exhaustion DoS, an out-of-bounds write via ubus params type confusion, a url_path leak, a CL.0 request smuggling desync and a leaked client refcount that wedges the listener. Fixes: https://github.com/openwrt/uhttpd/issues/3 Fixes: https://github.com/openwrt/uhttpd/issues/5 Fixes: https://github.com/openwrt/uhttpd/issues/10 Fixes: https://github.com/openwrt/uhttpd/issues/11 Fixes: https://github.com/openwrt/uhttpd/issues/14 Fixes: https://github.com/openwrt/uhttpd/issues/17 Closes: https://github.com/openwrt/uhttpd/issues/19 Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-vhx4-3p5q-m59q Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-2mpg-6wp5-435p Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-83vv-qrc6-h3hx Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-c2wg-hcff-hqrm Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-wvgh-cm54-q6f6 Link: https://github.com/openwrt/openwrt/pull/24680 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>