rfc822: prevent infinite loop on partial folded header lines #3

New issue

Closed

opened 2026-07-21 17:20:15 +02:00 by heiko · 1 comment

heiko commented

2026-07-21 17:20:15 +02:00

Owner

Problem

internal/rfc822/parser.go computes the next newline position as:

i := p.offset + bytes.Index(data[p.offset:], []byte{'\n'})
if i < 0 { ... }

When p.offset > 0 and bytes.Index returns -1, adding the offset can produce a nonnegative i. The “incomplete input” branch is skipped. For a folded header whose continuation bytes have arrived but whose next newline has not, the split function can repeatedly reuse the same offset and spin indefinitely.

This parser processes attacker-controlled email in the intended MTA deployment, so the bug is an availability/CPU-denial-of-service risk.

The unconditional log.Println("XXX:", p.offset) also leaks parser internals to stderr whenever this state occurs.

Checklist: #18 (unsafe integer/sentinel arithmetic).

Proposed fix

Check the relative index before adding the offset:

relative := bytes.IndexByte(data[p.offset:], '\n')
if relative < 0 {
    if atEOF { ... }
    return 0, nil, nil
}
i := p.offset + relative

Re-evaluate offset reset semantics for EOF and malformed headers, and remove the unconditional diagnostic.

Acceptance criteria

A reader that supplies a folded header in one-byte or deliberately awkward chunks completes without spinning.
EOF in the middle of a continuation line has documented behavior.
CRLF and LF fixtures still round-trip.
Add a regression test with a timeout and fuzz Parse/scanLines with chunked readers.
go test -race -shuffle=on ./... passes.

Reviewed against 948b7a9 on master (Go 1.26.2).

## Problem `internal/rfc822/parser.go` computes the next newline position as: ```go i := p.offset + bytes.Index(data[p.offset:], []byte{'\n'}) if i < 0 { ... } ``` When `p.offset > 0` and `bytes.Index` returns `-1`, adding the offset can produce a nonnegative `i`. The “incomplete input” branch is skipped. For a folded header whose continuation bytes have arrived but whose next newline has not, the split function can repeatedly reuse the same offset and spin indefinitely. This parser processes attacker-controlled email in the intended MTA deployment, so the bug is an availability/CPU-denial-of-service risk. The unconditional `log.Println("XXX:", p.offset)` also leaks parser internals to stderr whenever this state occurs. Checklist: #18 (unsafe integer/sentinel arithmetic). ## Proposed fix Check the relative index before adding the offset: ```go relative := bytes.IndexByte(data[p.offset:], '\n') if relative < 0 { if atEOF { ... } return 0, nil, nil } i := p.offset + relative ``` Re-evaluate offset reset semantics for EOF and malformed headers, and remove the unconditional diagnostic. ## Acceptance criteria - A reader that supplies a folded header in one-byte or deliberately awkward chunks completes without spinning. - EOF in the middle of a continuation line has documented behavior. - CRLF and LF fixtures still round-trip. - Add a regression test with a timeout and fuzz `Parse`/`scanLines` with chunked readers. - `go test -race -shuffle=on ./...` passes. Reviewed against `948b7a9` on `master` (Go 1.26.2).

heiko referenced this issue

2026-07-21 17:20:17 +02:00

refactor: replace mutable global maps, log functions, and embedded request/response state #7

heiko commented

2026-07-21 23:07:49 +02:00

Author

Owner

The partial folded-header spin is fixed, race-safe regression coverage is present, and the parser fuzz target with seeds is complete.

Closing commit: 403c6ef92db2

The partial folded-header spin is fixed, race-safe regression coverage is present, and the parser fuzz target with seeds is complete. Closing commit: [`403c6ef92db2`](https://forgejo.schlittermann.de/heiko/mail-seal/commit/403c6ef92db2e8e78b998aa6bf78a0f5d1664c43)

heiko closed this issue

2026-07-21 23:07:49 +02:00

heiko referenced this issue from a commit

2026-07-22 11:18:25 +02:00

test(rfc822): make folded-header spin guard reliable under -race

heiko referenced this issue from a commit

2026-07-22 11:18:25 +02:00

test(rfc822): add FuzzParse with spin-guard and seed corpus

heiko referenced this issue from a commit

2026-07-22 11:18:25 +02:00

test: add FuzzVerify for the signature-header decode path

heiko referenced this issue from a commit