mirror of
https://github.com/rclone/rclone.git
synced 2026-09-24 23:06:13 -04:00
Nick Craig-Wood
50b4d4c745
Three ways a single client could deny service to everyone else connected to the same serve sftp process: A session "subsystem" request payload is a length-prefixed string, but it was sliced at a fixed offset without checking its length, so a client sending a truncated payload panicked the out-of-band request goroutine and killed the process. Decode the payload instead, the way the neighbouring "exec" request already does. Rejecting a request then left the goroutine handling that channel waiting forever to learn what kind of channel it was, because nothing was ever sent on the channel it waits on. A client could open channels in a loop making unsupported requests and grow the server's goroutines and memory without bound. Signal the waiter when the requests run out so the channel is torn down. Separately, the request handlers - and reads, writes and closes on the file handles they return - run on pkg/sftp packet worker goroutines which have no panic recovery. A panic raised by a backend while serving one request took the process down with it. Recover panics at that boundary, log them with a stack trace, and return them to the requesting client as an error instead. Addresses GHSA-6jcg-q3wp-x2f4.