Skip to content

Commit

Permalink
Reduce buffer size to avoid pathological parsing
Browse files Browse the repository at this point in the history
[CVE-2018-16470]

Revert "Merge pull request #1192 from jkowens/master"

This reverts commit c43217a.
  • Loading branch information
tenderlove committed Nov 5, 2018
1 parent 99fea65 commit 37c1160
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/rack/multipart/parser.rb
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ module Multipart
class MultipartPartLimitError < Errno::EMFILE; end

class Parser
BUFSIZE = 1_048_576
BUFSIZE = 16384
TEXT_PLAIN = "text/plain"
TEMPFILE_FACTORY = lambda { |filename, content_type|
Tempfile.new(["RackMultipart", ::File.extname(filename.gsub("\0".freeze, '%00'.freeze))])
Expand Down

2 comments on commit 37c1160

@PikachuEXE
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a page describing CVE-2018-16470?

@michaelherold
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@PikachuEXE this description went out in the latest Rails security email.

Please sign in to comment.