FasterXML / jackson-dataformats-binary

Uber-project for standard Jackson binary format backends: avro, cbor, ion, protobuf, smile
Apache License 2.0
316 stars 136 forks source link

Allocate `byte[]` lazily for longer Smile binary data payloads (7-bit encoded) #265

Closed cowtowncoder closed 3 years ago

cowtowncoder commented 3 years ago

(note: no reproduction yet via oss-fuzz, but expecting one)

Similar to #260, lazy allocation is also needed for 7-bit escaped case, to avoid potential for small payload being used to add big memory allocation on server side (possibly leading to OOME, but even if not, unreasonably high memory usage), possibly as part of DoS attack.