4 ms·
> Yes, this family of flaws would have been impossible if curl had been written in a memory-safe language instead of C It could have been impossible, but you n
by dig1 3y ago
> Yes, this family of flaws would have been impossible if curl had been written in a memory-safe language instead of C
It could have been impossible, but you never know if there is a way to escape language VM barriers. However, the author clearly ignored the DNS hostname limit stated in RFC1123 [1], which is hardcoded even in Java libraries.
[1] https://www.rfc-editor.org/rfc/rfc1123 https://www.rfc-editor.org/rfc/rfc1123
- eesmith 3y agoCould you be more specific? All I saw was: Host software MUST handle host names of up to 63 characters and SHOULD handle host names of up to 255 characters. I don't see where the RFC sets a upper limit on host name size.
- dig1 3y ago6.1.3.5 Extensibility: The DNS defines domain name syntax very generally -- a string of labels each containing up to 63 8-bit octets, separated by dots, and with a maximum total of 255 octets. RFC1035 makes this more explicit [1]. [1] https://www.freesoft.org/CIE/RFC/1035/9.htm https://www.freesoft.org/CIE/RFC/1035/9.htm
- eesmith 3y agoThanks!
- matja 3y agoBy the wording of the RFC, accepting a hostname longer than 255 bytes is permissible, creating one is not.
- datenwolf 3y agomemory-safe language does not imply the use of a VM. It can just as well mean, that the compiler will attempt to execute a proof, that memory is never accessed out of bounds, without well defined ownership and within the lifetime of the underlying object. Which is what Rust does, for example. Of course it can also mean, that the compiler will then additionally add internal failure checks and safeguards at critical places (Rust does not do this, but it would be nice to have in systems where one might worry about in-register bit-flips (high radiation environments, like X-ray scanners), i.e. stuff not caught by – say – e.g. ECC memory).
- js2 3y agoIt's covered in the section titled "host name length": > A host name in a URL has no real size limit, but libcurl’s URL parser refuses to accept names longer than 65535 bytes. DNS only accepts host names up 253 bytes. So, a legitimate name that is longer than 253 bytes is unusual. A real name that is longer than 1024 is virtually unheard of. DNS is not the only mechanism for resolving host name to address, even if it's what's used 99.9% of the time today.
- jandrese 3y agoLegitimate requirements for hostnames longer than that have to be vanishingly small. I dare anybody to come up with a single anecdote from real world use.