diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2014-08-21 16:05:21 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2014-08-21 16:05:21 +0000 |
| commit | 5eec60b6e3415a34bd5237de153e27e9800dba8e (patch) | |
| tree | e8817b0db9de2787e26f88a3f51df1bc996b4acc /cgi.c | |
| parent | 6fe7b64a750e5f1ab77532bdf70912db94348867 (diff) | |
| download | mandoc-5eec60b6e3415a34bd5237de153e27e9800dba8e.tar.gz mandoc-5eec60b6e3415a34bd5237de153e27e9800dba8e.tar.zst mandoc-5eec60b6e3415a34bd5237de153e27e9800dba8e.zip | |
limit CGI process execution time to make REDoS attacks less effective;
attack surface pointed out by Sebastien Marie
Diffstat (limited to 'cgi.c')
| -rw-r--r-- | cgi.c | 16 |
1 files changed, 15 insertions, 1 deletions
@@ -1,4 +1,4 @@ -/* $Id: cgi.c,v 1.94 2014/08/17 03:24:47 schwarze Exp $ */ +/* $Id: cgi.c,v 1.95 2014/08/21 16:05:21 schwarze Exp $ */ /* * Copyright (c) 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2014 Ingo Schwarze <schwarze@usta.de> @@ -18,6 +18,7 @@ #include "config.h" #include <sys/types.h> +#include <sys/time.h> #include <ctype.h> #include <errno.h> @@ -1029,10 +1030,23 @@ int main(void) { struct req req; + struct itimerval itimer; const char *path; const char *querystring; int i; + /* Poor man's ReDoS mitigation. */ + + itimer.it_value.tv_sec = 1; + itimer.it_value.tv_usec = 0; + itimer.it_interval.tv_sec = 1; + itimer.it_interval.tv_usec = 0; + if (setitimer(ITIMER_VIRTUAL, &itimer, NULL) == -1) { + fprintf(stderr, "setitimer: %s\n", strerror(errno)); + pg_error_internal(); + return(EXIT_FAILURE); + } + /* Scan our run-time environment. */ if (NULL == (scriptname = getenv("SCRIPT_NAME"))) |