Commit 6488131 ("Fix RPC/SCGI security and crash bugs by @sirus20x6")
replaced std::vector<std::unique_ptr<const char>> storage with
std::vector<std::string> and returned back().c_str() to the xmlrpc-c
registry as the per-method server_info pointer.
This is unsafe for any method name short enough to be SSO-stored
(<= 15 chars on libstdc++): such a string keeps its buffer inside the
std::string object itself. When a later push_back reallocates the
vector and move-constructs the existing elements into a new buffer,
the previously returned c_str() pointers — captured by xmlrpc-c at
registration time — dangle into freed memory.
Because xmlrpc-c does not dereference server_info until a call
dispatches, the failure surfaces later as nondeterministic garbage
in fault strings, e.g.
faultString: Command "thod." does not exist. (load.start, log.xmlrpc, log.execute)
faultString: Command "in_rate" does not exist. (log.add_output)
faultString: Command "" does not exist. (log.open_file)
faultString: Command "+U" does not exist. (method.set_key)
Long-named methods (e.g. system.client_version at 21 chars) are
heap-allocated above the SSO threshold and escape the bug because
the heap buffer's address is preserved across the vector move.
Switch the storage to std::deque<std::string>: per [deque.modifiers]
push_back does not invalidate references to existing elements, so
the std::string objects do not move and the c_str() pointers handed
to xmlrpc-c remain valid for the program's lifetime. The body of
store_command_name is unchanged.
Fixes the use-after-free; preserves the std::string-based storage
the original commit aimed for.
By default, builds will still not have XMLRPC enabled at all and the
configure flag `--with-xmlrpc-tinyxml2` must be specified. If both
xmlrpc-c and tinyxml2 are specified, xmlrpc-c takes precedence.
Basic benchmarks indicate tinyxml2 is 2x faster for small
requests/responses, and that only increases as response sizes get
larger.
larger buffer size for handling direct loading of torrents through
xmlrpc.
* Allow file and tracker targets with the compact xmlrpc syntax,
e.g. "<infohash>:f<id>".
* Fixed an alignment bug in the DHT code.
git-svn-id: svn://rakshasa.no/libtorrent/trunk/rtorrent@1040 e378c898-3ddf-0310-93e7-cc216c733640
* Moved most of src/ui/download.cc to use commands for TextElements.
git-svn-id: svn://rakshasa.no/libtorrent/trunk/rtorrent@967 e378c898-3ddf-0310-93e7-cc216c733640
* Cleaned up duplicate code in 'xmlrpc.cc'.
* Cleaned up 'parse_commands.h'.
git-svn-id: svn://rakshasa.no/libtorrent/trunk/rtorrent@966 e378c898-3ddf-0310-93e7-cc216c733640
xmlrpc command takes the download info-hash and the file index as the
first two parameters.
* Added several file commands.
git-svn-id: svn://rakshasa.no/libtorrent/trunk/rtorrent@937 e378c898-3ddf-0310-93e7-cc216c733640
parameter of the get_d/set_d commands is the info-hash.
git-svn-id: svn://rakshasa.no/libtorrent/trunk/rtorrent@917 e378c898-3ddf-0310-93e7-cc216c733640
utils::VariableMap::call_command(...).
* More cleanup of the command calls.
git-svn-id: svn://rakshasa.no/libtorrent/trunk/rtorrent@895 e378c898-3ddf-0310-93e7-cc216c733640
Xirvik