pacman

History

Dave Reisner 6dc71926f9 lib/dload: prevent large file attacks This means creating a new struct which can pass more descriptive data from the back end sync functions to the downloader. In particular, we're interested in the download size read from the sync DB. When the remote server reports a size larger than this (via a content-length header), abort the transfer. In cases where the size is unknown, we set a hard upper limit of: * 25MiB for a sync DB * 16KiB for a signature For reference, 25MiB is more than twice the size of all of the current binary repos (with files) combined, and 16KiB is a truly gargantuan signature. Signed-off-by: Dave Reisner <dreisner@archlinux.org>	2011-07-05 22:58:55 -04:00
..
libalpm	lib/dload: prevent large file attacks	2011-07-05 22:58:55 -04:00

Dave Reisner 6dc71926f9 lib/dload: prevent large file attacks

This means creating a new struct which can pass more descriptive data
from the back end sync functions to the downloader. In particular, we're
interested in the download size read from the sync DB. When the remote
server reports a size larger than this (via a content-length header),
abort the transfer.

In cases where the size is unknown, we set a hard upper limit of:

* 25MiB for a sync DB
* 16KiB for a signature

For reference, 25MiB is more than twice the size of all of the current
binary repos (with files) combined, and 16KiB is a truly gargantuan
signature.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>

2011-07-05 22:58:55 -04:00

libalpm

lib/dload: prevent large file attacks

2011-07-05 22:58:55 -04:00