]> Cypherpunks repositories - gostls13.git/commit
net/textproto, mime/multipart: improve accounting of non-file data
authorDamien Neil <dneil@google.com>
Thu, 16 Mar 2023 23:56:12 +0000 (16:56 -0700)
committerGopher Robot <gobot@golang.org>
Tue, 4 Apr 2023 17:01:58 +0000 (17:01 +0000)
commit3c010f2c2182a12f28ad86c5e1ff984f1f2d880a
tree2915ded045c64503337d2bc4bcdb834034b88f7f
parent3549c613b9d354d9f5410afc54dc9f7e6393c8cf
net/textproto, mime/multipart: improve accounting of non-file data

For requests containing large numbers of small parts,
memory consumption of a parsed form could be about 250%
over the estimated size.

When considering the size of parsed forms, account for the size of
FileHeader structs and increase the estimate of memory consumed by
map entries.

Thanks to Jakob Ackermann (@das7pad) for reporting this issue.

For CVE-2023-24536
For #59153

Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802454
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
Change-Id: I9620758495ed77c09ca6dc5db4b723c29f3baad8
Reviewed-on: https://go-review.googlesource.com/c/go/+/482076
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>
src/mime/multipart/formdata.go
src/mime/multipart/formdata_test.go
src/net/textproto/reader.go