fujin/rtorrent
1
0
Fork 0
mirror of https://github.com/rakshasa/rtorrent.git synced 2026-08-09 11:42:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash on untrusted XMLRPC connections

Browse Source 
Root cause: network.rpc.use_xmlrpc and network.rpc.use_jsonrpc were not
marked as untrusted-safe, but RpcManager::process() calls them before
dispatching to the protocol handler. When an untrusted request arrived,
call_command() threw untrusted_error for these gatekeepers, which escaped
the callback_interrupt_pollling callback and crashed rtorrent.

Fix: Mark network.rpc.use_xmlrpc/jsonrpc as safe (CMD2_VAR_BOOL_U).

Also harden exception safety:
- SCGI callback catch-all now sends a generic error response instead of
  re-throwing, since the callback infrastructure may not support
  exception propagation.
- xmlrpc_c.cc now has catch(std::exception&) and catch(...) safety nets
  after the specific exception handlers.
This commit is contained in:
Xirvik
2026-03-01 18:24:24 +00:00
committed by Jari Sundell
parent f767053297
commit ea16276773
3 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/command_network.cc
+2 -2
View File
@@ -248,8 +248,8 @@ initialize_command_network() {
CMD2_ANY_U ("network.xmlrpc.size_limit", [](const auto&, const auto&) { return rpc::rpc.size_limit(); });
CMD2_ANY_VALUE_V_U ("network.xmlrpc.size_limit.set", [](const auto&, const auto& arg) { return rpc::rpc.set_size_limit(arg); });
CMD2_VAR_BOOL ("network.rpc.use_xmlrpc", true);
CMD2_VAR_BOOL ("network.rpc.use_jsonrpc", true);
CMD2_VAR_BOOL_U ("network.rpc.use_xmlrpc", true);
CMD2_VAR_BOOL_U ("network.rpc.use_jsonrpc", true);
CMD2_ANY ("network.block.ipv4", [nw_config](auto, auto) { return nw_config->is_block_ipv4(); });
CMD2_ANY_VALUE_V ("network.block.ipv4.set", [nw_config](auto, auto& value) { return nw_config->set_block_ipv4(value); });