search

FasterXML / jackson-dataformats-binary

Uber-project for standard Jackson binary format backends: avro, cbor, ion, protobuf, smile
Apache License 2.0
310 stars 133 forks source link

Allocate `byte[]` lazily for longer Smile binary data payloads (raw) #260

Closed cowtowncoder closed 3 years ago

cowtowncoder commented 3 years ago

(from https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32180)

Looks like eager allocation is used for Smile binary payload if using "raw"/native embedding. Similar to #186, this should be only used for relatively short payloads to avoid potential for DoS by attacker specifying allegedly large data size but only sending minimal partial message (essentially just marker, length and maybe a bit or two)

cowtowncoder commented 3 years ago

The issue seems oddly resistant to reproduction: for some reason, allocating a 2-gig byte array succeeds despite my trying to limit heap to 0.5 gigs (for example).

cowtowncoder commented 3 years ago

Needed to add Surefire (junit) plugin configuration to limit heap for forked-off test process, now test fails as expected from command-line.