Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 03:30 UTC
core: reject overlong ports in ParseNetworkAddress (#8277)
jasper committed
Oct 31, 2026 at 18:57 UTC
61e9b223da88ff0a3ffec39410b83d66a75d762d
2 files changed
+42
listeners.go
+6
@@ -348,6 +348,9 @@ func ParseNetworkAddressWithDefaults(addr, defaultNetwork string, defaultPort ui
348
start = uint64(defaultPort)
349
end = uint64(defaultPort)
350
} else {
351
+ if len(port) > maxPortLen {
352
+ return NetworkAddress{}, fmt.Errorf("invalid port: longer than %d characters", maxPortLen)
353
+ }
354
before, after, found := strings.Cut(port, "-")
355
if !found {
356
after = before
@@ -776,3 +779,6 @@ type PacketConnWrapper interface {
779
var listenerPool = NewUsagePool()
780
781
const maxPortSpan = 65535
782
+
783
+// maxPortLen is the length of the longest valid port range.
784
+const maxPortLen = len("65535-65535")
listeners_test.go
+36
@@ -19,6 +19,7 @@ import (
19
"crypto/tls"
20
"net"
21
"reflect"
22
+ "strings"
23
"testing"
24
25
"github.com/caddyserver/caddy/v2/internal"
@@ -343,6 +344,21 @@ func TestParseNetworkAddress(t *testing.T) {
344
defaultNetwork: "tcp",
345
expectErr: true,
346
},
347
+ {
348
+ input: "localhost:65535-65535",
349
+ defaultNetwork: "tcp",
350
+ expectAddr: NetworkAddress{
351
+ Network: "tcp",
352
+ Host: "localhost",
353
+ StartPort: 65535,
354
+ EndPort: 65535,
355
+ },
356
+ },
357
+ {
358
+ input: "localhost:000000000080",
359
+ defaultNetwork: "tcp",
360
+ expectErr: true,
361
+ },
362
} {
363
actualAddr, err := ParseNetworkAddressWithDefaults(tc.input, tc.defaultNetwork, tc.defaultPort)
364
if tc.expectErr && err == nil {
@@ -361,6 +377,26 @@ func TestParseNetworkAddress(t *testing.T) {
377
}
378
}
379
380
+// A very long port should fail with a short error (issue #8229).
381
+func TestParseNetworkAddressLongPort(t *testing.T) {
382
+ junk := strings.Repeat("\x7f", 1<<20)
383
+ for i, input := range []string{
384
+ ":" + junk,
385
+ ":80-" + junk,
386
+ ":" + junk + "-80",
387
+ "localhost:" + strings.Repeat("9", 1<<20),
388
+ } {
389
+ _, err := ParseNetworkAddress(input)
390
+ if err == nil {
391
+ t.Errorf("Test %d: expected error but got none", i)
392
+ continue
393
+ }
394
+ if len(err.Error()) > 100 {
395
+ t.Errorf("Test %d: error message is %d bytes, expected at most 100", i, len(err.Error()))
396
+ }
397
+ }
398
+}
399
+
400
func TestParseNetworkAddressWithDefaults(t *testing.T) {
401
for i, tc := range []struct {
402
input string