Harden Gopher parsing and recover server goroutinesHEADv1.6.4main

Reject oversized or malformed Gopher selectors as parse errors instead of panicking. Keep search requests bounded, and wrap shared server goroutines with panic logging so one bad connection cannot take down the process.

1 files changed, 16 insertions, 0 deletions

diff --git a/internal/server.go b/internal/server.go
index 46b95ef..3ae9be2 100644
--- a/internal/server.go
+++ b/internal/server.go
@@ -2,7 +2,9 @@ package internal
 
 import (
 	"context"
+	"fmt"
 	"net"
+	"runtime/debug"
 	"strings"
 	"sync"
 
@@ -84,6 +86,7 @@ func (s *Server) Serve() error {
 		go func() {
 			defer s.Wg.Done()
 			defer func() { _ = conn.Close() }()
+			defer s.recoverPanic("connection", "remote", conn.RemoteAddr().String())
 			s.HandleConn(conn)
 		}()
 	}
@@ -129,12 +132,25 @@ func (s *Server) propagateClose() {
 	s.Wg.Add(1)
 	go func() {
 		defer s.Wg.Done()
+		defer s.recoverPanic("close propagation")
 
 		<-s.Ctx.Done()
 		_ = s.Listener.Close()
 	}()
 }
 
+func (s *Server) recoverPanic(goroutine string, keyvals ...any) {
+	if r := recover(); r != nil {
+		keyvals = append([]any{
+			"msg", "panic in server goroutine",
+			"goroutine", goroutine,
+			"panic", fmt.Sprintf("%v", r),
+			"stack", string(debug.Stack()),
+		}, keyvals...)
+		_ = s.ErrorLog.Log(keyvals...)
+	}
+}
+
 // JoinDefaultPort appends ":<port>" iff the address does not already contain a port.
 func JoinDefaultPort(address string, port string) string {
 	if len(address) > 0 && address[0] == '[' {