Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential infinite loop in binary packet decoding #357

Closed
yhx-12243 opened this issue Aug 14, 2024 · 0 comments
Closed

Potential infinite loop in binary packet decoding #357

yhx-12243 opened this issue Aug 14, 2024 · 0 comments
Assignees
Labels
bug Something isn't working vulnerability This reference a vulnerability found on socketioxide or engineioxide

Comments

@yhx-12243
Copy link
Contributor

yhx-12243 commented Aug 14, 2024

Describe the bug
When server receive a binary packet (45...) without -, it will get a infinite loop.

https://github.com/Totodore/socketioxide/blob/d796728/socketioxide/src/packet.rs#L456-L458

To Reproduce
Steps to reproduce the behavior:
Let engineIo be the official engine-io client.

sock = new engineIo();
sock.send('0');
sock.send('5');

1
(No rejection, No further ping-pong, CPU got 100%)

Expected behavior
Refuse this packet.

Versions (please complete the following information):

  • Socketioxide version: 0.14.0
  • Http lib: 1.1.0
  • Socket.io client version: manual hacking
@yhx-12243 yhx-12243 added the bug Something isn't working label Aug 14, 2024
@Totodore Totodore added the vulnerability This reference a vulnerability found on socketioxide or engineioxide label Aug 14, 2024
yhx-12243 added a commit to yhx-12243/socketioxide that referenced this issue Aug 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working vulnerability This reference a vulnerability found on socketioxide or engineioxide
Projects
None yet
Development

No branches or pull requests

2 participants