zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-08 19:30:15 +02:00
Code Issues Projects Releases Packages Wiki Activity

irc-cap: limit number of unique CAP signals emitted

Browse source 
A malicious server can send an unbounded number of unique CAP tokens
in CAP LS, ACK, NAK, NEW, or DEL responses. Each unique token creates
a dynamic signal name via cap_emit_signal(), which is permanently
interned by the signal system via module_get_uniq_id_str(). Over time
this leaks memory without bound for the lifetime of the session.

Fix: skip signal emission once the server has advertised more than
256 unique CAP tokens. This is a generous bound; real servers advertise
10-50 caps.
This commit is contained in:
Devon Kirk 2026-07-01 17:16:32 -04:00
commit cd0a8d29e4
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/irc/core/irc-cap.c
View file

@ -78,7 +78,16 @@ static void cap_emit_signal (IRC_SERVER_REC *server, char *cmd, char *args)
{
char *signal_name;
signal_name = g_strdup_printf("server cap %s %s", cmd, args? args: "");
if (args == NULL)
return;
/* Cap the number of unique CAP signals emitted per server to prevent
* unbounded signal-name interning from server-controlled CAP tokens. */
if (server->cap_supported == NULL ||
g_hash_table_size(server->cap_supported) > 256)
return;
signal_name = g_strdup_printf("server cap %s %s", cmd, args);
signal_emit(signal_name, 1, server);
g_free(signal_name);
}