Skip to content

Increase OPENDMARC_ARCSEAL_MAX_TOKEN_LEN to 768#225

Closed
abokth wants to merge 1 commit into
trusteddomainproject:developfrom
abokth:arcseal-tokenlen-develop
Closed

Increase OPENDMARC_ARCSEAL_MAX_TOKEN_LEN to 768#225
abokth wants to merge 1 commit into
trusteddomainproject:developfrom
abokth:arcseal-tokenlen-develop

Conversation

@abokth
Copy link
Copy Markdown

@abokth abokth commented Jul 6, 2022

Enough for 3072 bit key signatures. Should fix #183.

@thegushi
Copy link
Copy Markdown
Collaborator

Thank you for this fix — bumping the token length constant was the right instinct and this PR helped identify the root cause.

Two gaps remained that PR #296 addresses:

  1. The same limit (OPENDMARC_ARCSEAL_MAX_LONG_VALUE_LEN) also exists in opendmarc-arcseal.h and controls the size of the signature_value field in struct arcseal. Bumping only the .c constant left the struct field at 512 bytes, so values from large-key signatures would still be silently truncated. PR Fix ARC header parsing crashes: SIGABRT on malformed tokens and SIGSEGV on large RSA key signatures #296 bumps both constants, and raises the limit to 2048 (covering RSA 4096-bit and larger).

  2. A second, independent crash path existed where a token with no = sign (e.g. ARC-Seal: i=1; none) caused NULL to be passed to strip_whitespace(), triggering assert(string != NULL) → SIGABRT. That needed a separate guard.

  3. The same issues also existed in the opendmarc-arcares.c parser, which was not covered here.

Closing in favour of #296, which addresses all of the above. Thanks again for the contribution!

@thegushi thegushi closed this May 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants