From 14ca21065558cc48014a7c8c7aca40f7c6560713 Mon Sep 17 00:00:00 2001 From: Carter Li Date: Tue, 28 Jul 2026 13:29:47 +0800 Subject: [PATCH] Networking: adds Content-Length size limit to prevent excessive memory allocation and potential attacks --- src/common/impl/networking_linux.c | 7 +++++++ src/common/impl/networking_windows.c | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/src/common/impl/networking_linux.c b/src/common/impl/networking_linux.c index 86cab30bf..adc692897 100644 --- a/src/common/impl/networking_linux.c +++ b/src/common/impl/networking_linux.c @@ -457,6 +457,13 @@ const char* ffNetworkingRecvHttpResponse(FFNetworkingState* state, FFstrbuf* buf if (clHeader) { contentLength = (uint32_t) strtoul(clHeader + 15, NULL, 10); if (contentLength > 0) { + if (contentLength > 1024 * 1024) { // 1MB limit to prevent excessive memory allocation and potential attacks + FF_DEBUG("Content-Length is too large: %u bytes, aborting", contentLength); + close(state->sockfd); + state->sockfd = -1; + return "Content-Length too large"; + } + FF_DEBUG("Detected Content-Length: %u, pre-allocating buffer", contentLength); // Ensure buffer is large enough, adding header size and some margin ffStrbufEnsureFree(buffer, contentLength + 16); diff --git a/src/common/impl/networking_windows.c b/src/common/impl/networking_windows.c index 3ad793196..2c36f2db7 100644 --- a/src/common/impl/networking_windows.c +++ b/src/common/impl/networking_windows.c @@ -322,6 +322,13 @@ const char* ffNetworkingRecvHttpResponse(FFNetworkingState* state, FFstrbuf* buf if (clHeader) { contentLength = (uint32_t) strtoul(clHeader + 15, NULL, 10); if (contentLength > 0) { + if (contentLength > 1024 * 1024) { // 1MB limit to prevent excessive memory allocation and potential attacks + FF_DEBUG("Content-Length is too large: %u bytes, aborting", contentLength); + closesocket(state->sockfd); + state->sockfd = INVALID_SOCKET; + return "Content-Length too large"; + } + FF_DEBUG("Detected Content-Length: %u, pre-allocating buffer", contentLength); // Ensure buffer is large enough, adding header size and some margin ffStrbufEnsureFree(buffer, contentLength + 16);