From 880da53aade83854e2fe30cd19a05ceccf93f501 Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Thu, 9 Jul 2026 17:13:04 -0400 Subject: [PATCH] dcc: enforce declared receive size DCC GET trusts the sender-provided size for UI and auto-get policy but continues writing until the peer closes the connection. A sender can advertise a small file and exhaust the receiver filesystem. Limit each read to the remaining declared byte count and close the transfer once that count has been reached. --- src/irc/dcc/dcc-get.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/irc/dcc/dcc-get.c b/src/irc/dcc/dcc-get.c index cc1c9e43..8296fb57 100644 --- a/src/irc/dcc/dcc-get.c +++ b/src/irc/dcc/dcc-get.c @@ -150,15 +150,24 @@ static void sig_dccget_send(GET_DCC_REC *dcc) /* input function: DCC GET received data */ static void sig_dccget_receive(GET_DCC_REC *dcc) { - int ret; + uoff_t remaining; + int ret, read_size; if (dcc_get_recv_buffer == NULL) { dcc_get_recv_buffer = g_malloc(DCC_GET_RECV_BUFFER_SIZE); } for (;;) { + if (dcc->transfd >= dcc->size) { + dcc_close(DCC(dcc)); + return; + } + + remaining = dcc->size - dcc->transfd; + read_size = remaining > DCC_GET_RECV_BUFFER_SIZE ? + DCC_GET_RECV_BUFFER_SIZE : (int) remaining; ret = net_receive(dcc->handle, dcc_get_recv_buffer, - DCC_GET_RECV_BUFFER_SIZE); + read_size); if (ret == 0) break; if (ret < 0) {