authorgravatar for hello@nektro.netMeghan Denny <hello@nektro.net> 2026-05-10 19:30:45 -07:00
committergravatar for hello@nektro.netMeghan Denny <hello@nektro.net> 2026-05-10 19:30:45 -07:00
log0a8d64bb2fed9a5a79b6c49b91c1efeff4cb19d6
treea67972a9d85f8de51bf835596d3b09fb087a527b
parenta4957630082ff3a926f0564148b443c8703cc2f8
signaturebadge-check Signed by SSH key SHA256:4hHJbtBRU58AYXwjL7fkz2fnQHdiye8x1QpTCQ0sHNw

cap Server.receiveHead at 128 request headers, could be a dos attempt otherwise

1 files changed, 1 insertions(+), 0 deletions(-)

http.zig+1
...@@ -421,6 +421,7 @@ pub const Server = struct {...@@ -421,6 +421,7 @@ pub const Server = struct {
421 while (true) {421 while (true) {
422 const line = try server.reader.readUntilDelimitersBuf(&scratch_buffer, "\r\n");422 const line = try server.reader.readUntilDelimitersBuf(&scratch_buffer, "\r\n");
423 if (line.len == 0) break;423 if (line.len == 0) break;
424 if (headers.count() == 128) return error.InvalidRequest;
424 const name_end = std.mem.indexOfScalar(u8, line, ':') orelse return error.InvalidRequest;425 const name_end = std.mem.indexOfScalar(u8, line, ':') orelse return error.InvalidRequest;
425 const name = line[0..name_end];426 const name = line[0..name_end];
426 for (name) |*c| {427 for (name) |*c| {