1 files changed, 85 insertions, 0 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/eventservice/0008-Add-checks-on-Event-Subscription-input-parameters.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/eventservice/0008-Add-checks-on-Event-Subscription-input-parameters.patch
new file mode 100644
index 000000000..65bfafdcc
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/eventservice/0008-Add-checks-on-Event-Subscription-input-parameters.patch
@@ -0,0 +1,85 @@
+From a22fcc269c475b0ff8a80a6aa2c837b247eca907 Mon Sep 17 00:00:00 2001
+From: Nitin Wankhade <nitinx.arunrao.wankhade@intel.com>
+Date: Mon, 28 Jun 2021 19:59:57 +0000
+Subject: [PATCH] Add checks on Event Subscription input parameters
+
+There is no check on the size of input parameters(Context,
+Destination and Header) during Event Subscription.This
+creates out of memory situation.
+This commit checks for the size of input parameters and
+rejects if it is exceeding the input size limits.
+
+Tested
+  - Validated using POST on Event Subscription.
+  - When Context, Destination and Headers were too long,
+    received a error message denoting the same.
+
+Change-Id: Iec2cd766c0e137b72706fc2da468d4fefd8fbaae
+Signed-off-by: Nitin Wankhade <nitinx.arunrao.wankhade@intel.com>
+Signed-off-by: P Dheeraj Srujan Kumar <p.dheeraj.srujan.kumar@intel.com>
+---
+ redfish-core/lib/event_service.hpp | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/redfish-core/lib/event_service.hpp b/redfish-core/lib/event_service.hpp
+index 88ebd01..373c873 100644
+--- a/redfish-core/lib/event_service.hpp
++++ b/redfish-core/lib/event_service.hpp
+@@ -22,6 +22,10 @@
+ 
+ #include <span>
+ 
++#define MAX_CONTEXT_SIZE 256
++#define MAX_DESTINATION_SIZE 1024
++#define MAX_HEADER_SIZE 8096
++
+ namespace redfish
+ {
+ static constexpr const std::array<const char*, 3> supportedRetryPolicies = {
+@@ -229,6 +233,12 @@ inline void requestRoutesEventDestinationCollection(App& app)
+                 return;
+             }
+ 
++            if (destUrl.size() > MAX_DESTINATION_SIZE)
++            {
++                messages::propertySizeExceeded(asyncResp->res, "Destination");
++                return;
++            }
++
+             if (regPrefixes && msgIds)
+             {
+                 if (!regPrefixes->empty() && !msgIds->empty())
+@@ -336,13 +346,30 @@ inline void requestRoutesEventDestinationCollection(App& app)
+ 
+             if (context)
+             {
++                if (context->size() > MAX_CONTEXT_SIZE)
++                {
++                    messages::propertySizeExceeded(asyncResp->res, "Context");
++                    return;
++                }
+                 subValue->customText = *context;
+             }
+ 
+             if (headers)
+             {
++                size_t cumulativeLen = 0;
++
+                 for (const nlohmann::json& headerChunk : *headers)
+                 {
++                    std::string hdr{headerChunk.dump(
++                        -1, ' ', true,
++                        nlohmann::json::error_handler_t::replace)};
++                    cumulativeLen += hdr.length();
++                    if (cumulativeLen > MAX_HEADER_SIZE)
++                    {
++                        messages::propertySizeExceeded(asyncResp->res,
++                                                       "HttpHeaders");
++                        return;
++                    }
+                     for (const auto& item : headerChunk.items())
+                     {
+                         const std::string* value =
+-- 
+2.25.1
+