4 ms·

I'm trying to under the last comment > the SOCKS5 proxy is too slow to handle the request immediately the request seg faults immediately, no delays, no redire

by kiviuq 3y ago

I'm trying to under the last comment > the SOCKS5 proxy is too slow to handle the request immediately the request seg faults immediately, no delays, no redirects root@1aac5e228e16:/build/curl-7.74.0# curl -vvv -x socks5h://host.docker.internal:9050 $(python3 -c "print(('A'10000), end='')") Trying 192.168.65.254:9050... * SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=10000] * SOCKS5 connect to AAAAA... * Send failure: Bad file descriptor * Failed to send SOCKS5 connect request. Segmentation fault https://gist.github.com/xen0bit/0dccb11605abbeb6021963e2b1a811d3 https://gist.github.com/xen0bit/0dccb11605abbeb6021963e2b1a8...

deng 3y ago
Yes sorry, I was wrong. The CVE says the opposite, I put an EDIT in the OP.
deng 3y ago
I'm confused why plain 'curl' would crash here: the CVE says that "The target buffer is the heap-based download buffer in libcurl that is reused for SOCKS negotiation before the transfer has started. The size of the buffer is 16kB by default, but can be set to different sizes by the application. The curl tool sets it to 102400 bytes by default - but it sets the buffer size to a smaller size if --limit-rate is set lower than 102400 bytes per second." I thought with a buffer of 100kB, this bug wouldn't trigger?