diff options
author | Kevin McCarthy <kevin@8t8.us> | 2020-05-19 12:26:55 -0700 |
---|---|---|
committer | Kevin McCarthy <kevin@8t8.us> | 2020-05-19 13:11:40 -0700 |
commit | c72f740aa7c80c0a79775628e62daa2a43357cd5 (patch) | |
tree | 3ccec4d2762f9a2b4c5e5d248155a61db6bf7279 /handler.c | |
parent | a4059dd2e770175148ef61be943fad6c132356ea (diff) |
Add mitigation against DoS from thousands of parts.
A demonstration attack using a million tiny parts will freeze Mutt for
several minutes. This is actually better than some other mail
software, but can still be a problem at large levels.
For now, set it to a very conservative 5000, but this can be adjusted
up (or down) if necessary.
Declare the previous stack-limit max depth as a constant too, and
decrease it down to 50. Change the handler to return non-fatal "1" on
reaching the limit.
Diffstat (limited to 'handler.c')
-rw-r--r-- | handler.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -1782,10 +1782,10 @@ int mutt_body_handler (BODY *b, STATE *s) int oflags = s->flags; - if (recurse_level >= 100) + if (recurse_level >= MUTT_MIME_MAX_DEPTH) { dprint (1, (debugfile, "mutt_body_handler: recurse level too deep. giving up!\n")); - return -1; + return 1; } recurse_level++; |