Changeset 11130 in ntrip for trunk/BNC/src/bncnetqueryv1.cpp

Timestamp:

Oct 28, 2026, 9:32:30 AM (10 days ago)

Author:

stuerze

Message:

Some fixes from security point of view

File:

• trunk/BNC/src/bncnetqueryv1.cpp (modified) (2 diffs)

trunk/BNC/src/bncnetqueryv1.cpp

@@ -253 +253 @@
     bool proxyResponse = false;
     QStringList response;
+    const int maxResponseSize = 16384;
+    int responseSize = 0;
     while (true) {
       if (_socket->canReadLine()) {
         QString line = _socket->readLine();
+
+        // a caster response header is short; do not collect an endless one
+        responseSize += line.size();
+        if (responseSize > maxResponseSize) {
+          delete _socket;
+          _socket = 0;
+          _status = error;
+          emit newMessage(_url.path().toLatin1().replace(0,1,"")
+                          + ": Caster response header too long", true);
+          return;
+        }
     
         if (line.indexOf("ICY 200 OK") == -1 && 
@@ -289 +302 @@
         break;
         }
+      }
+      else if (_socket->bytesAvailable() > maxResponseSize) { // no line end
+        delete _socket;
+        _socket = 0;
+        _status = error;
+        emit newMessage(_url.path().toLatin1().replace(0,1,"")
+                        + ": Caster response header too long", true);
+        return;
       }
       else if (!_socket->waitForReadyRead(_timeOut)) {