mirrors/Xray-core
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2025-06-12 11:29:36 +03:00
Code Issues Releases Activity

Fix DoS attack vulnerability in VMess Option Processing

Browse Source
This commit is contained in:
Shelikhoo
2022-06-12 23:29:09 +01:00
committed by yuhan6665
parent ba4ce4c24f
commit d4f18b1342
4 changed files with 72 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
proxy/vmess/inbound/inbound.go
View File

@ -184,8 +184,10 @@ func (h *Handler) RemoveUser(ctx context.Context, email string) error {
func transferResponse(timer signal.ActivityUpdater, session *encoding.ServerSession, request *protocol.RequestHeader, response *protocol.ResponseHeader, input buf.Reader, output *buf.BufferedWriter) error {
session.EncodeResponseHeader(response, output)
bodyWriter := session.EncodeResponseBody(request, output)
bodyWriter, err := session.EncodeResponseBody(request, output)
if err != nil {
return newError("failed to start decoding response").Base(err)
}
{
// Optimize for small response packet
data, err := input.ReadMultiBuffer()
@ -301,7 +303,10 @@ func (h *Handler) Process(ctx context.Context, network net.Network, connection s
requestDone := func() error {
defer timer.SetTimeout(sessionPolicy.Timeouts.DownlinkOnly)
bodyReader := svrSession.DecodeRequestBody(request, reader)
bodyReader, err := svrSession.DecodeRequestBody(request, reader)
if err != nil {
return newError("failed to start decoding").Base(err)
}
if err := buf.Copy(bodyReader, link.Writer, buf.UpdateActivity(timer)); err != nil {
return newError("failed to transfer request").Base(err)
}