Harden receiver cancellation, deadlines, and manifest validation #202

Closed
opened 2026-08-08 20:09:22 +02:00 by TapTap · 0 comments
Owner

Severity

High

Description

Several malformed-input paths can exhaust or wedge a receiver: accepted sockets lack receive/send timeouts, protocol deadlines are checked only before blocking reads, manifest counts are unbounded and decode failures are ignored, and multithreaded receiver errors can leave writer/join state blocked.

Location

  • src/shared/protocol.c:119-156
  • src/shared/transport_tcp.c:81-113
  • src/shared/transport_tls.c:97-114
  • src/shared/file.c:716-733
  • src/shared/multiprocessing.c:165-247

Validation

Connect and send only part of a length field while keeping the socket open; send an oversized/truncated manifest; disconnect during a multithreaded chunk transfer. Confirm the worker remains occupied or the handler fails to return.

Suggested implementation

Apply deadlines to accepted sockets and TLS handshakes (poll/nonblocking where needed), bound manifest counts and reject every decode/allocation failure, and use one cancellation cleanup path that marks completion and broadcasts all queue conditions before joining threads. Add malformed-protocol and disconnect tests.

## Severity High ## Description Several malformed-input paths can exhaust or wedge a receiver: accepted sockets lack receive/send timeouts, protocol deadlines are checked only before blocking reads, manifest counts are unbounded and decode failures are ignored, and multithreaded receiver errors can leave writer/join state blocked. ## Location - src/shared/protocol.c:119-156 - src/shared/transport_tcp.c:81-113 - src/shared/transport_tls.c:97-114 - src/shared/file.c:716-733 - src/shared/multiprocessing.c:165-247 ## Validation Connect and send only part of a length field while keeping the socket open; send an oversized/truncated manifest; disconnect during a multithreaded chunk transfer. Confirm the worker remains occupied or the handler fails to return. ## Suggested implementation Apply deadlines to accepted sockets and TLS handshakes (poll/nonblocking where needed), bound manifest counts and reject every decode/allocation failure, and use one cancellation cleanup path that marks completion and broadcasts all queue conditions before joining threads. Add malformed-protocol and disconnect tests.
TapTap added the bugsecurityqualityneeds-triage labels 2026-08-08 20:09:22 +02:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: TapTap/FastSync#202