mirror of
https://github.com/rakshasa/rtorrent.git
synced 2026-08-14 22:22:31 +00:00
Fix crash on untrusted XMLRPC connections
Root cause: network.rpc.use_xmlrpc and network.rpc.use_jsonrpc were not marked as untrusted-safe, but RpcManager::process() calls them before dispatching to the protocol handler. When an untrusted request arrived, call_command() threw untrusted_error for these gatekeepers, which escaped the callback_interrupt_pollling callback and crashed rtorrent. Fix: Mark network.rpc.use_xmlrpc/jsonrpc as safe (CMD2_VAR_BOOL_U). Also harden exception safety: - SCGI callback catch-all now sends a generic error response instead of re-throwing, since the callback infrastructure may not support exception propagation. - xmlrpc_c.cc now has catch(std::exception&) and catch(...) safety nets after the specific exception handlers.
This commit is contained in:
@@ -396,6 +396,14 @@ xmlrpc_call_command(xmlrpc_env* env, xmlrpc_value* args, void* voidServerInfo) {
|
||||
} catch (torrent::local_error& e) {
|
||||
xmlrpc_env_set_fault(env, XMLRPC_PARSE_ERROR, e.what());
|
||||
return NULL;
|
||||
|
||||
} catch (std::exception& e) {
|
||||
xmlrpc_env_set_fault(env, XMLRPC_PARSE_ERROR, e.what());
|
||||
return NULL;
|
||||
|
||||
} catch (...) {
|
||||
xmlrpc_env_set_fault(env, XMLRPC_PARSE_ERROR, "Unknown exception in command execution.");
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user