Erlang OTP inets invalid chunk size hang vulnerability analysis

Vulnerability Overview Commit Message: Issue Description: Prior to the fix, when an invalid chunk size was received, the server would reject the request, but it was possible to hang the process without sending any bytes, potentially causing the server to become unresponsive. Commit Hash: Author: garazdaz, committed 2 weeks ago (Verified) Branch/Tag: master, OTP-27.3.4.17 Scope of Impact Affected Module: (Erlang/OTP HTTP server module) Affected Files: - (+14 lines modified) - (+81 lines of new tests) Trigger Condition: An HTTP request with an invalid chunk size (e.g., with an illegal chunk size) causes the server process to hang. Fix Details 1. Core Fix ( ): - In , added validation for when handling messages: - If is , call to handle it; - If is , update the module data; - If is , update the module data size; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data; - If is , update the module data size; - If is , update the module data;

Goal Reached Thanks to every supporter — we hit 100%!

Erlang OTP inets invalid chunk size hang vulnerability analysis

More from this source