From 68904ba00534ada11e5ed572f6dfa75c80c340e7 Mon Sep 17 00:00:00 2001 From: xirvik Date: Mon, 10 Aug 2026 06:03:44 +0000 Subject: [PATCH] Limit the padding string.rpad and string.lpad will build. An untrusted caller could exhaust memory or the response limit. --- src/command_string.cc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/command_string.cc b/src/command_string.cc index 0a7d7062..30d38a0c 100644 --- a/src/command_string.cc +++ b/src/command_string.cc @@ -19,6 +19,8 @@ namespace { +constexpr int64_t max_string_pad_size = 1 << 20; + const std::string whitespace_characters = " \t\n\r\f\v"; // The byte offset of every utf-8 character in 'text', terminated by the offset @@ -249,10 +251,14 @@ apply_string_pad(const char* name, const torrent::Object::list_type& args, bool if (pad_size <= text_length || padding.empty()) return text; + if (pad_size - text_length > max_string_pad_size) + throw torrent::input_error(std::string(name) + ": padding is too large."); + auto padding_offsets = utf8_offsets(padding); auto padding_length = static_cast(padding_offsets.size() - 1); std::string result; + result.reserve(pad_size - text_length); for (int64_t i = 0; i < pad_size - text_length; i++) { auto index = static_cast(i % padding_length);