lib/dload: prevent large file attacks

This means creating a new struct which can pass more descriptive data
from the back end sync functions to the downloader. In particular, we're
interested in the download size read from the sync DB. When the remote
server reports a size larger than this (via a content-length header),
abort the transfer.

In cases where the size is unknown, we set a hard upper limit of:

* 25MiB for a sync DB
* 16KiB for a signature

For reference, 25MiB is more than twice the size of all of the current
binary repos (with files) combined, and 16KiB is a truly gargantuan
signature.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>

4 files changed, 87 insertions, 40 deletions

diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c
index a784536b..f681fc8e 100644
--- a/lib/libalpm/be_sync.c
+++ b/lib/libalpm/be_sync.c
@@ -172,16 +172,21 @@ int SYMEXPORT alpm_db_update(int force, alpm_db_t *db)
 
 	for(i = db->servers; i; i = i->next) {
 		const char *server = i->data;
-		char *fileurl;
+		struct dload_payload *payload;
 		size_t len;
 		int sig_ret = 0;
 
+		CALLOC(payload, 1, sizeof(*payload), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
+
+		/* set hard upper limit of 25MiB */
+		payload->max_size = 25 * 1024 * 1024;
+
 		/* print server + filename into a buffer (leave space for .sig) */
 		len = strlen(server) + strlen(db->treename) + 9;
-		CALLOC(fileurl, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
-		snprintf(fileurl, len, "%s/%s.db", server, db->treename);
+		CALLOC(payload->fileurl, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
+		snprintf(payload->fileurl, len, "%s/%s.db", server, db->treename);
 
-		ret = _alpm_download(handle, fileurl, syncpath, NULL, force, 0, 0);
+		ret = _alpm_download(handle, payload, syncpath, NULL, force, 0, 0);
 
 		if(ret == 0 && (level & ALPM_SIG_DATABASE)) {
 			/* an existing sig file is no good at this point */
@@ -195,14 +200,17 @@ int SYMEXPORT alpm_db_update(int force, alpm_db_t *db)
 
 			int errors_ok = (level & ALPM_SIG_DATABASE_OPTIONAL);
 			/* if we downloaded a DB, we want the .sig from the same server */
-			snprintf(fileurl, len, "%s/%s.db.sig", server, db->treename);
+			snprintf(payload->fileurl, len, "%s/%s.db.sig", server, db->treename);
+
+			/* set hard upper limit of 16KiB */
+			payload->max_size = 16 * 1024;
 
-			sig_ret = _alpm_download(handle, fileurl, syncpath, NULL, 1, 0, errors_ok);
+			sig_ret = _alpm_download(handle, payload, syncpath, NULL, 1, 0, errors_ok);
 			/* errors_ok suppresses error messages, but not the return code */
 			sig_ret = errors_ok ? 0 : sig_ret;
 		}
 
-		FREE(fileurl);
+		_alpm_dload_payload_free(payload);
 		if(ret != -1 && sig_ret != -1) {
 			break;
 		}
diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c
index e9ff6213..1f0ea9ce 100644
--- a/lib/libalpm/dload.c
+++ b/lib/libalpm/dload.c
@@ -177,7 +177,7 @@ static size_t parse_headers(void *ptr, size_t size, size_t nmemb, void *user)
 	return realsize;
 }
 
-static int curl_download_internal(alpm_handle_t *handle, const char *url,
+static int curl_download_internal(alpm_handle_t *handle, struct dload_payload *payload,
 		const char *localpath, char **final_file, int force, int allow_resume,
 		int errors_ok)
 {
@@ -197,10 +197,10 @@ static int curl_download_internal(alpm_handle_t *handle, const char *url,
 
 	dlfile.handle = handle;
 	dlfile.initial_size = 0.0;
-	dlfile.filename = get_filename(url);
+	dlfile.filename = payload->filename ? payload->filename : get_filename(payload->fileurl);
 	dlfile.cd_filename = NULL;
-	if(!dlfile.filename || curl_gethost(url, hostname) != 0) {
-		_alpm_log(handle, ALPM_LOG_ERROR, _("url '%s' is invalid\n"), url);
+	if(!dlfile.filename || curl_gethost(payload->fileurl, hostname) != 0) {
+		_alpm_log(handle, ALPM_LOG_ERROR, _("url '%s' is invalid\n"), payload->fileurl);
 		RET_ERR(handle, ALPM_ERR_SERVER_BAD_URL, -1);
 	}
 
@@ -238,7 +238,7 @@ static int curl_download_internal(alpm_handle_t *handle, const char *url,
 	/* the curl_easy handle is initialized with the alpm handle, so we only need
 	 * to reset the curl handle set parameters for each time it's used. */
 	curl_easy_reset(handle->curl);
-	curl_easy_setopt(handle->curl, CURLOPT_URL, url);
+	curl_easy_setopt(handle->curl, CURLOPT_URL, payload->fileurl);
 	curl_easy_setopt(handle->curl, CURLOPT_FAILONERROR, 1L);
 	curl_easy_setopt(handle->curl, CURLOPT_ERRORBUFFER, error_buffer);
 	curl_easy_setopt(handle->curl, CURLOPT_CONNECTTIMEOUT, 10L);
@@ -252,6 +252,10 @@ static int curl_download_internal(alpm_handle_t *handle, const char *url,
 	curl_easy_setopt(handle->curl, CURLOPT_HEADERFUNCTION, parse_headers);
 	curl_easy_setopt(handle->curl, CURLOPT_WRITEHEADER, &dlfile);
 
+	if(payload->max_size) {
+		curl_easy_setopt(handle->curl, CURLOPT_MAXFILESIZE, payload->max_size);
+	}
+
 	useragent = getenv("HTTP_USER_AGENT");
 	if(useragent != NULL) {
 		curl_easy_setopt(handle->curl, CURLOPT_USERAGENT, useragent);
@@ -407,18 +411,19 @@ cleanup:
  * @param errors_ok do not log errors (but still return them)
  * @return 0 on success, -1 on error (pm_errno is set accordingly if errors_ok == 0)
  */
-int _alpm_download(alpm_handle_t *handle, const char *url, const char *localpath,
-		char **final_file, int force, int allow_resume, int errors_ok)
+int _alpm_download(alpm_handle_t *handle, struct dload_payload *payload,
+		const char *localpath, char **final_file, int force, int allow_resume,
+		int errors_ok)
 {
 	if(handle->fetchcb == NULL) {
 #ifdef HAVE_LIBCURL
-		return curl_download_internal(handle, url, localpath, final_file, force,
+		return curl_download_internal(handle, payload, localpath, final_file, force,
 				allow_resume, errors_ok);
 #else
 		RET_ERR(handle, ALPM_ERR_EXTERNAL_DOWNLOAD, -1);
 #endif
 	} else {
-		int ret = handle->fetchcb(url, localpath, force);
+		int ret = handle->fetchcb(payload->fileurl, localpath, force);
 		if(ret == -1 && !errors_ok) {
 			RET_ERR(handle, ALPM_ERR_EXTERNAL_DOWNLOAD, -1);
 		}
@@ -432,6 +437,7 @@ char SYMEXPORT *alpm_fetch_pkgurl(alpm_handle_t *handle, const char *url)
 	char *filepath;
 	const char *cachedir;
 	char *final_file = NULL;
+	struct dload_payload *payload;
 	int ret;
 
 	CHECK_HANDLE(handle, return NULL);
@@ -439,8 +445,11 @@ char SYMEXPORT *alpm_fetch_pkgurl(alpm_handle_t *handle, const char *url)
 	/* find a valid cache dir to download to */
 	cachedir = _alpm_filecache_setup(handle);
 
+	CALLOC(payload, 1, sizeof(*payload), RET_ERR(handle, ALPM_ERR_MEMORY, NULL));
+	payload->fileurl = strdup(url);
+
 	/* download the file */
-	ret = _alpm_download(handle, url, cachedir, &final_file, 0, 1, 0);
+	ret = _alpm_download(handle, payload, cachedir, &final_file, 0, 1, 0);
 	if(ret == -1) {
 		_alpm_log(handle, ALPM_LOG_WARNING, _("failed to download %s\n"), url);
 		return NULL;
@@ -449,32 +458,44 @@ char SYMEXPORT *alpm_fetch_pkgurl(alpm_handle_t *handle, const char *url)
 
 	/* attempt to download the signature */
 	if(ret == 0 && (handle->siglevel & ALPM_SIG_PACKAGE)) {
-		char *sig_url;
 		char *sig_final_file = NULL;
 		size_t len;
 		int errors_ok = (handle->siglevel & ALPM_SIG_PACKAGE_OPTIONAL);
+		struct dload_payload *sig_payload;
 
+		CALLOC(sig_payload, 1, sizeof(*sig_payload), RET_ERR(handle, ALPM_ERR_MEMORY, NULL));
 		len = strlen(url) + 5;
-		CALLOC(sig_url, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, NULL));
-		snprintf(sig_url, len, "%s.sig", url);
+		CALLOC(sig_payload->fileurl, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, NULL));
+		snprintf(sig_payload->fileurl, len, "%s.sig", url);
+		sig_payload->max_size = 1024 * 16;
 
-		ret = _alpm_download(handle, sig_url, cachedir, &sig_final_file, 1, 0, errors_ok);
+		ret = _alpm_download(handle, sig_payload, cachedir, &sig_final_file, 1, 0, errors_ok);
 		if(ret == -1 && !errors_ok) {
-			_alpm_log(handle, ALPM_LOG_WARNING, _("failed to download %s\n"), sig_url);
+			_alpm_log(handle, ALPM_LOG_WARNING, _("failed to download %s\n"), sig_payload->fileurl);
 			/* Warn now, but don't return NULL. We will fail later during package
 			 * load time. */
 		} else if(ret == 0) {
-			_alpm_log(handle, ALPM_LOG_DEBUG, "successfully downloaded %s\n", sig_url);
+			_alpm_log(handle, ALPM_LOG_DEBUG, "successfully downloaded %s\n", sig_payload->fileurl);
 		}
-		FREE(sig_url);
 		FREE(sig_final_file);
+		_alpm_dload_payload_free(sig_payload);
 	}
 
 	/* we should be able to find the file the second time around */
 	filepath = _alpm_filecache_find(handle, final_file);
 	FREE(final_file);
+	_alpm_dload_payload_free(payload);
 
 	return filepath;
 }
 
+void _alpm_dload_payload_free(struct dload_payload *payload) {
+	struct dload_payload *load = (struct dload_payload *)payload;
+
+	ASSERT(load, return);
+
+	FREE(load->fileurl);
+	FREE(load);
+}
+
 /* vim: set ts=2 sw=2 noet: */
diff --git a/lib/libalpm/dload.h b/lib/libalpm/dload.h
index 351b2b30..6a2dd392 100644
--- a/lib/libalpm/dload.h
+++ b/lib/libalpm/dload.h
@@ -33,8 +33,17 @@ struct fileinfo {
 	double initial_size;
 };
 
-int _alpm_download(alpm_handle_t *handle, const char *url, const char *localpath,
-		char **final_file, int force, int allow_resume, int errors_ok);
+struct dload_payload {
+	char *filename;
+	char *fileurl;
+	long max_size;
+};
+
+void _alpm_dload_payload_free(struct dload_payload *payload);
+
+int _alpm_download(alpm_handle_t *handle, struct dload_payload *payload,
+		const char *localpath, char **final_file, int force, int allow_resume,
+		int errors_ok);
 
 #endif /* _ALPM_DLOAD_H */
 
diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c
index 54b96a7a..969af3c0 100644
--- a/lib/libalpm/sync.c
+++ b/lib/libalpm/sync.c
@@ -765,10 +765,6 @@ static int download_files(alpm_handle_t *handle, alpm_list_t **deltas)
 			alpm_pkg_t *spkg = j->data;
 
 			if(spkg->origin != PKG_FROM_FILE && current == spkg->origin_data.db) {
-				const char *fname = NULL;
-
-				fname = alpm_pkg_get_filename(spkg);
-				ASSERT(fname != NULL, RET_ERR(handle, ALPM_ERR_PKG_INVALID_NAME, -1));
 				alpm_list_t *delta_path = spkg->delta_path;
 				if(delta_path) {
 					/* using deltas */
@@ -776,14 +772,27 @@ static int download_files(alpm_handle_t *handle, alpm_list_t **deltas)
 					for(dlts = delta_path; dlts; dlts = dlts->next) {
 						alpm_delta_t *delta = dlts->data;
 						if(delta->download_size != 0) {
-							files = alpm_list_add(files, strdup(delta->delta));
+							struct dload_payload *dpayload;
+
+							CALLOC(dpayload, 1, sizeof(*dpayload), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
+							STRDUP(dpayload->filename, delta->delta, RET_ERR(handle, ALPM_ERR_MEMORY, -1));
+							dpayload->max_size = delta->download_size;
+
+							files = alpm_list_add(files, dpayload);
 						}
 						/* keep a list of all the delta files for md5sums */
 						*deltas = alpm_list_add(*deltas, delta);
 					}
 
 				} else if(spkg->download_size != 0) {
-					files = alpm_list_add(files, strdup(fname));
+					struct dload_payload *payload;
+
+					ASSERT(spkg->filename != NULL, RET_ERR(handle, ALPM_ERR_PKG_INVALID_NAME, -1));
+					CALLOC(payload, 1, sizeof(*payload), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
+					STRDUP(payload->filename, spkg->filename, RET_ERR(handle, ALPM_ERR_MEMORY, -1));
+					payload->max_size = alpm_pkg_get_size(spkg);
+
+					files = alpm_list_add(files, payload);
 				}
 
 			}
@@ -792,21 +801,19 @@ static int download_files(alpm_handle_t *handle, alpm_list_t **deltas)
 		if(files) {
 			EVENT(handle->trans, ALPM_TRANS_EVT_RETRIEVE_START, current->treename, NULL);
 			for(j = files; j; j = j->next) {
-				const char *filename = j->data;
+				struct dload_payload *payload = j->data;
 				alpm_list_t *server;
 				int ret = -1;
 				for(server = current->servers; server; server = server->next) {
 					const char *server_url = server->data;
-					char *fileurl;
 					size_t len;
 
 					/* print server + filename into a buffer */
-					len = strlen(server_url) + strlen(filename) + 2;
-					CALLOC(fileurl, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
-					snprintf(fileurl, len, "%s/%s", server_url, filename);
+					len = strlen(server_url) + strlen(payload->filename) + 2;
+					CALLOC(payload->fileurl, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
+					snprintf(payload->fileurl, len, "%s/%s", server_url, payload->filename);
 
-					ret = _alpm_download(handle, fileurl, cachedir, NULL, 0, 1, 0);
-					FREE(fileurl);
+					ret = _alpm_download(handle, payload, cachedir, NULL, 0, 1, 0);
 					if(ret != -1) {
 						break;
 					}
@@ -816,7 +823,9 @@ static int download_files(alpm_handle_t *handle, alpm_list_t **deltas)
 				}
 			}
 
-			FREELIST(files);
+			alpm_list_free_inner(files, (alpm_list_fn_free)_alpm_dload_payload_free);
+			alpm_list_free(files);
+			files = NULL;
 			if(errors) {
 				_alpm_log(handle, ALPM_LOG_WARNING, _("failed to retrieve some files from %s\n"),
 						current->treename);