From 3017e795e8c27a669e73aab0c89f05cd593dd19f Mon Sep 17 00:00:00 2001
From: anim001k <140460766+anim001k@users.noreply.github.com>
Date: Thu, 25 Sep 2025 10:38:36 +0200
Subject: [PATCH] Update version_check.go

---
 cmd/geth/version_check.go | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/cmd/geth/version_check.go b/cmd/geth/version_check.go
index 237556788e..7554a479b3 100644
--- a/cmd/geth/version_check.go
+++ b/cmd/geth/version_check.go
@@ -25,6 +25,8 @@ import (
 	"os"
 	"regexp"
 	"strings"
+	"time"
+	"strconv"
 
 	"github.com/ethereum/go-ethereum/log"
 	"github.com/jedisct1/go-minisign"
@@ -115,15 +117,33 @@ func fetch(url string) ([]byte, error) {
 	if filep := strings.TrimPrefix(url, "file://"); filep != url {
 		return os.ReadFile(filep)
 	}
-	res, err := http.Get(url)
+	const maxBodySize = 2 << 20 // 2 MiB
+
+	client := &http.Client{
+		Timeout: 10 * time.Second,
+	}
+	res, err := client.Get(url)
 	if err != nil {
 		return nil, err
 	}
 	defer res.Body.Close()
-	body, err := io.ReadAll(res.Body)
+	
+	if res.StatusCode < 200 || res.StatusCode >= 300 {
+		return nil, fmt.Errorf("unexpected status: %s", res.Status)
+	}
+	if cl := res.Header.Get("Content-Length"); cl != "" {
+		if n, _ := strconv.ParseInt(cl, 10, 64); n > maxBodySize {
+			return nil, fmt.Errorf("response too large: %d > %d", n, maxBodySize)
+		}
+	}
+	limited := io.LimitReader(res.Body, maxBodySize+1)
+	body, err := io.ReadAll(limited)
 	if err != nil {
 		return nil, err
 	}
+	if int64(len(body)) > maxBodySize {
+		return nil, fmt.Errorf("response exceeds limit: > %d", maxBodySize)
+	}
 	return body, nil
 }