mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-08-21 17:45:02 +00:00
88240172ea
RegexMatcher::match() called std::regex_match() directly on the attacker-controlled request path. For quantified patterns such as "(.*)", std::regex_match's recursive backtracking implementation (most acute on libstdc++) recurses roughly once per matched character, so a long enough path can exhaust the calling thread's stack and crash the process. Verified against real GNU libstdc++: under the default thread stack size, a path of a couple thousand characters against a simple quantified route pattern reliably crashed the process, well within the existing 8192-byte request URI limit. Add CPPHTTPLIB_REGEX_ROUTE_PATH_MAX_LENGTH (default 256) and reject paths longer than it before ever calling std::regex_match, treating them as a non-match instead. Confirmed the fix eliminates the crash under the same libstdc++ build and default stack size that reproduced it.
