libwebsockets/lib
Andy Green d678ea3cd2 renable deflate frame buffer expansion fixing DoS
This reverts the removal of the deflate_frame code that was crashing after porting
David Galeano's code: he pointed out there's a typo in the merged version causing
the crash which is fixed here.

However the fixed code has a problem, there's no limit (other than int size) to the
amount of memory it will try to malloc, which can allow a DoS of the server by the
client sending malicious compression states that inflate to a large amount.  I have
added checking for OOM already that will avert the segfault that would otherwise follow
but the server will be unusuable if malicious connections were made repeatedly each
forcing it to allocate large buffers and cause small allocations on other connections
to fail.

The patch changes the code to use realloc(), and introduces a configurable limit
on the amount of memory one connection may need for zlib before the server hangs
up the connection.  It defaults to 64KBytes but can be set from ./configure as
described now in the README.

Signed-off-by: Andy Green <andy.green@linaro.org>
2013-01-12 23:36:27 +08:00
..
.gitignore Ignoring linux build files 2013-01-09 15:46:11 +08:00
base64-decode.c introduce logging api and convert all library output to use it 2013-01-10 22:16:37 +08:00
client-handshake.c audit and make all malloc check for OOM 2013-01-12 13:21:08 +08:00
extension-deflate-frame.c renable deflate frame buffer expansion fixing DoS 2013-01-12 23:36:27 +08:00
extension-deflate-frame.h Separate compression levels for server and client, 2013-01-10 12:45:54 +08:00
extension-deflate-stream.c introduce logging api and convert all library output to use it 2013-01-10 22:16:37 +08:00
extension-deflate-stream.h Fixed deflate-stream extension. 2013-01-09 18:17:42 +08:00
extension-x-google-mux.c audit and make all malloc check for OOM 2013-01-12 13:21:08 +08:00
extension-x-google-mux.h Use __inline for Win32 builds. 2013-01-10 10:07:16 +08:00
extension.c Added extension "deflate-frame". 2013-01-09 18:21:33 +08:00
getifaddrs.c introduce getifaddrs for toolchains without it 2013-01-12 20:39:47 +08:00
getifaddrs.h introduce getifaddrs for toolchains without it 2013-01-12 20:39:47 +08:00
handshake.c audit and make all malloc check for OOM 2013-01-12 13:21:08 +08:00
libwebsockets.c introduce getifaddrs for toolchains without it 2013-01-12 20:39:47 +08:00
libwebsockets.h logging extend level set api to allow setting emission function 2013-01-12 09:17:42 +08:00
Makefile.am introduce getifaddrs for toolchains without it 2013-01-12 20:39:47 +08:00
md5.c introduce-private-md5-sha1.patch 2011-01-23 17:47:08 +00:00
parsers.c audit and make all malloc check for OOM 2013-01-12 13:21:08 +08:00
private-libwebsockets.h introduce logging api and convert all library output to use it 2013-01-10 22:16:37 +08:00
sha-1.c Static variable is now const. 2013-01-09 15:14:31 +08:00