Several malformed-input paths can exhaust or wedge a receiver: accepted sockets lack receive/send timeouts, protocol deadlines are checked only before blocking reads, manifest counts are unbounded and decode failures are ignored, and multithreaded receiver errors can leave writer/join state blocked.
Location
src/shared/protocol.c:119-156
src/shared/transport_tcp.c:81-113
src/shared/transport_tls.c:97-114
src/shared/file.c:716-733
src/shared/multiprocessing.c:165-247
Validation
Connect and send only part of a length field while keeping the socket open; send an oversized/truncated manifest; disconnect during a multithreaded chunk transfer. Confirm the worker remains occupied or the handler fails to return.
Suggested implementation
Apply deadlines to accepted sockets and TLS handshakes (poll/nonblocking where needed), bound manifest counts and reject every decode/allocation failure, and use one cancellation cleanup path that marks completion and broadcasts all queue conditions before joining threads. Add malformed-protocol and disconnect tests.
## Severity
High
## Description
Several malformed-input paths can exhaust or wedge a receiver: accepted sockets lack receive/send timeouts, protocol deadlines are checked only before blocking reads, manifest counts are unbounded and decode failures are ignored, and multithreaded receiver errors can leave writer/join state blocked.
## Location
- src/shared/protocol.c:119-156
- src/shared/transport_tcp.c:81-113
- src/shared/transport_tls.c:97-114
- src/shared/file.c:716-733
- src/shared/multiprocessing.c:165-247
## Validation
Connect and send only part of a length field while keeping the socket open; send an oversized/truncated manifest; disconnect during a multithreaded chunk transfer. Confirm the worker remains occupied or the handler fails to return.
## Suggested implementation
Apply deadlines to accepted sockets and TLS handshakes (poll/nonblocking where needed), bound manifest counts and reject every decode/allocation failure, and use one cancellation cleanup path that marks completion and broadcasts all queue conditions before joining threads. Add malformed-protocol and disconnect tests.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity
High
Description
Several malformed-input paths can exhaust or wedge a receiver: accepted sockets lack receive/send timeouts, protocol deadlines are checked only before blocking reads, manifest counts are unbounded and decode failures are ignored, and multithreaded receiver errors can leave writer/join state blocked.
Location
Validation
Connect and send only part of a length field while keeping the socket open; send an oversized/truncated manifest; disconnect during a multithreaded chunk transfer. Confirm the worker remains occupied or the handler fails to return.
Suggested implementation
Apply deadlines to accepted sockets and TLS handshakes (poll/nonblocking where needed), bound manifest counts and reject every decode/allocation failure, and use one cancellation cleanup path that marks completion and broadcasts all queue conditions before joining threads. Add malformed-protocol and disconnect tests.