Skip to content

ssh: stop reading behind a large output backlog - #1353

Open
ejohnstown wants to merge 1 commit into
wolfSSL:masterfrom
ejohnstown:output-backlog
Open

ejohnstown wants to merge 1 commit into
wolfSSL:masterfrom
ejohnstown:output-backlog

Conversation

@ejohnstown

Copy link
Copy Markdown
Contributor

wolfSSH_worker() and wolfSSH_stream_read() stop taking input once more
than WOLFSSH_MAX_OUTPUT_BACKLOG bytes of replies are queued, so a peer
that never reads can no longer grow outputBuffer without bound.

  • The cap defaults to two MAX_PACKET_SZ and can be overridden
  • Over the cap, a read flushes first and returns WS_WANT_WRITE if the
    backlog is still over
  • regress: unknown-id and GLOBAL_REQUEST floods stop at the cap and
    drain once the peer reads

Issue: F-16808

wolfSSH_worker() and wolfSSH_stream_read() now flush before reading
once more than WOLFSSH_MAX_OUTPUT_BACKLOG bytes are queued, and return
WS_WANT_WRITE without reading if the flush leaves it over. A peer that
never reads can no longer grow outputBuffer one reply per packet.

- WOLFSSH_MAX_OUTPUT_BACKLOG defaults to two MAX_PACKET_SZ, overridable
- A smaller backlog still reads first, keeping the PR 856 order
- regress: unknown-id and GLOBAL_REQUEST floods with blocked sends stop
  at the cap and drain once the peer reads

Issue: F-16808
Copilot AI balanced review requested due to automatic review settings October 29, 2026 22:28

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fenrir Automated Review — PR #1353

Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: wolfssh/internal.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants