[EXPORTER] OTLP HTTP exporter reads unbounded response (open-telemetry#4078)

Author: marcalff

CHANGELOG.md

@@ -107,6 +107,21 @@ Increment the:
 * [BUILD] Upgrade to rapidyaml 0.12.1
   [#4076](https://github.com/open-telemetry/opentelemetry-cpp/pull/4076)
 
+* [EXPORTER] OTLP HTTP exporters read unbounded HTTP response
+  [#4078](https://github.com/open-telemetry/opentelemetry-cpp/pull/4078)
+
+Security fix:
+
+* [EXPORTER] OTLP HTTP exporters read unbounded HTTP response
+  [#4078](https://github.com/open-telemetry/opentelemetry-cpp/pull/4078)
+
+  * When exporting OTLP HTTP data to a misconfigured or malicious endpoint,
+    the exporter could allocate an arbitrary amount of memory when getting
+    the endpoint HTTP response back.
+  * The size of HTTP responses is now limited to 4MiB by default,
+    following the opentelemetry-proto recommendations.
+  * See CVE-2026-44967
+
 Important changes:
 
 * Enable WITH_OTLP_RETRY_PREVIEW by default

ext/include/opentelemetry/ext/http/client/curl/http_operation_curl.h

@@ -43,6 +43,14 @@ const std::chrono::milliseconds kDefaultHttpConnTimeout(5000);  // ms
 const std::string kHttpStatusRegexp = "HTTP\\/\\d\\.\\d (\\d+)\\ .*";
 const std::string kHttpHeaderRegexp = "(.*)\\: (.*)\\n*";
 
+/**
+ * Default max HTTP Response size.
+ * 4MiB
+ * @see
+ * https://github.com/open-telemetry/opentelemetry-proto/blob/main/docs/specification.md#otlphttp-response
+ */
+const size_t kDefaultMaxResponseSize = 4 * 1024 * 1024;
+
 class HttpClient;
 class Session;
 
@@ -198,6 +206,12 @@ class HttpOperation
    */
   std::chrono::system_clock::time_point NextRetryTime();
 
+  /**
+   * Limit memory consumption on HTTP response.
+   * Size is @c kDefaultMaxResponseSize by default.
+   */
+  void SetMaxResponseSize(size_t max_size) { max_response_size_ = max_size; }
+
   /**
    * Setup request
    */
@@ -342,6 +356,8 @@ class HttpOperation
   std::vector<uint8_t> response_headers_;
   std::vector<uint8_t> response_body_;
   std::vector<uint8_t> raw_response_;
+  /** Max HTTP response size. */
+  size_t max_response_size_{kDefaultMaxResponseSize};
 
   struct AsyncData
   {

ext/src/http/client/curl/http_operation_curl.cc

@@ -77,8 +77,43 @@ size_t HttpOperation::WriteMemoryCallback(void *contents, size_t size, size_t nm
     return 0;
   }
 
-  self->raw_response_.insert(self->raw_response_.end(), static_cast<char *>(contents),
-                             static_cast<char *>(contents) + (size * nmemb));
+  const size_t data_size = size * nmemb;
+
+  // This code is defensive on purpose, to avoid allocation of unbound
+  // amounts of memory, controlled by the (remote) endpoint response.
+
+  // 1: Check data_size did not overflow
+  if (nmemb != 0)
+  {
+    if (data_size / nmemb != size)
+    {
+      // Should be impossible, really:
+      // CURL will report a huge response small chunks at a time,
+      // not in one block, which would be a DOS in CURL already.
+      return 0;
+    }
+  }
+
+  // 2: Check internal integrity
+  if (self->raw_response_.size() > self->max_response_size_)
+  {
+    // Should be impossible,
+    // this means the previous call did exceed the max size already.
+    return 0;
+  }
+
+  // 3: Protect against memory exhaustion caused by the remote endpoint
+  if (data_size > self->max_response_size_ - self->raw_response_.size())
+  {
+    // This one is possible and must be protected against (CVE-2026-44967).
+    // Checks 1 and 2 ensure the math is correct.
+    return 0;
+  }
+
+  const unsigned char *begin = static_cast<unsigned char *>(contents);
+  const unsigned char *end   = begin + data_size;
+
+  self->raw_response_.insert(self->raw_response_.end(), begin, end);
 
   if (self->WasAborted())
   {
@@ -95,7 +130,7 @@ size_t HttpOperation::WriteMemoryCallback(void *contents, size_t size, size_t nm
     self->DispatchEvent(opentelemetry::ext::http::client::SessionState::Sending);
   }
 
-  return size * nmemb;
+  return data_size;
 }
 
 size_t HttpOperation::WriteVectorHeaderCallback(void *ptr, size_t size, size_t nmemb, void *userp)
@@ -106,8 +141,33 @@ size_t HttpOperation::WriteVectorHeaderCallback(void *ptr, size_t size, size_t n
     return 0;
   }
 
+  const size_t data_size = size * nmemb;
+
+  // See comments in HttpOperation::WriteMemoryCallback().
+
+  if (nmemb != 0)
+  {
+    if (data_size / nmemb != size)
+    {
+      return 0;
+    }
+  }
+
+  // Common limit for header + body
+  if (self->response_headers_.size() + self->response_body_.size() > self->max_response_size_)
+  {
+    return 0;
+  }
+
+  if (data_size >
+      self->max_response_size_ - self->response_headers_.size() - self->response_body_.size())
+  {
+    return 0;
+  }
+
   const unsigned char *begin = static_cast<unsigned char *>(ptr);
-  const unsigned char *end   = begin + size * nmemb;
+  const unsigned char *end   = begin + data_size;
+
   self->response_headers_.insert(self->response_headers_.end(), begin, end);
 
   if (self->WasAborted())
@@ -125,7 +185,7 @@ size_t HttpOperation::WriteVectorHeaderCallback(void *ptr, size_t size, size_t n
     self->DispatchEvent(opentelemetry::ext::http::client::SessionState::Sending);
   }
 
-  return size * nmemb;
+  return data_size;
 }
 
 size_t HttpOperation::WriteVectorBodyCallback(void *ptr, size_t size, size_t nmemb, void *userp)
@@ -136,8 +196,33 @@ size_t HttpOperation::WriteVectorBodyCallback(void *ptr, size_t size, size_t nme
     return 0;
   }
 
+  const size_t data_size = size * nmemb;
+
+  // See comments in HttpOperation::WriteMemoryCallback().
+
+  if (nmemb != 0)
+  {
+    if (data_size / nmemb != size)
+    {
+      return 0;
+    }
+  }
+
+  // Common limit for header + body
+  if (self->response_headers_.size() + self->response_body_.size() > self->max_response_size_)
+  {
+    return 0;
+  }
+
+  if (data_size >
+      self->max_response_size_ - self->response_headers_.size() - self->response_body_.size())
+  {
+    return 0;
+  }
+
   const unsigned char *begin = static_cast<unsigned char *>(ptr);
-  const unsigned char *end   = begin + size * nmemb;
+  const unsigned char *end   = begin + data_size;
+
   self->response_body_.insert(self->response_body_.end(), begin, end);
 
   if (self->WasAborted())
@@ -155,7 +240,7 @@ size_t HttpOperation::WriteVectorBodyCallback(void *ptr, size_t size, size_t nme
     self->DispatchEvent(opentelemetry::ext::http::client::SessionState::Sending);
   }
 
-  return size * nmemb;
+  return data_size;
 }
 
 size_t HttpOperation::ReadMemoryCallback(char *buffer, size_t size, size_t nitems, void *userp)