Details
-
Bug
-
Resolution: Done
-
P2: Important
-
5.5.0
-
None
-
Tested on Xubuntu 14.04 with Qt 5.5.
-
12e424f241b29ef26ad2a3a70740d8b320e9e85a
Description
QWebSocketServer is vulnerable to a DoS attack caused by improper parsing of WebSocket handshake. This happens because QWebSocketServer attempts to read from the client until a newline is encountered. If no newline is sent it will read data from the client until all available memory is consumed.
Addendum: when valid header lines are sent (terminated by CRLF), but when no blank line is sent (double CRLF), then the same behaviour occurs.