Closed catenacyber closed 1 year ago
See previously https://github.com/golang/go/issues/27635 and https://github.com/golang/go/issues/28321.
Can we have some function to set ourselves
tooBig
?
For the sake of fuzzing, I guess you could patch the codebase to change the constant to whatever you see fit.
I'm not sure whether it makes sense to add an API option just for that limit; if we were to improve the API for handling untrusted data, I think we would have to do it more generally, like https://github.com/golang/go/issues/20221.
This ends up allocating 4GB from encoding/gob.(*Decoder).decodeSlice
Sorry, is this the bug? Is allocating 4GB OOM? Or what is it? It is unclear to me what the problem is. Thanks.
Can we have some function to set ourselves tooBig ?
I'm not sure I understand what the purpose of adjusting tooBig is. Could you clarify? (But based on the comment above, this is probably not what we're going to do.)
decodeSlice is preemptively allocating a slice as described by a malformed gob message, which describes a very large slice but not its content, by using reflect.MakeSlice. Because of this an adversarial, or corrupt, message can cause a very small message to consume a very large amount of memory.
One solution is not preallocating the slice and using reflect.Append instead to grow it (this will presumably have some performance impact.)
$ go version go version go1.17.6 darwin/amd64
What version of Go do you use? Go 1.17.6 is no longer supported. I understand that the bug may still exist, but could you use newer version and report bugs for a supported version of Go? Thanks.
go version go version go1.19 windows/amd64
Will output Hello, 世界 But in https://go.dev/play/p/nQR5wqtQV1K?v=gotip , Will output Program exited.
Let's just use reflect.Append
. Sent https://go.dev/cl/433296.
Change https://go.dev/cl/433296 mentions this issue: encoding/gob: use saferio.SliceCap when decoding a slice
What version of Go do you use? Go 1.17.6 is no longer supported. I understand that the bug may still exist, but could you use newer version and report bugs for a supported version of Go? Thanks.
I actually now use go version go1.18.3 darwin/amd64 But I just copy pasted the previous reports ;-) And I use the playground to test these reports
What version of Go are you using (
go version
)?Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (
go env
)?go env
OutputWhat did you do?
Run https://go.dev/play/p/nQR5wqtQV1K?v=gotip
What did you expect to see?
The program finishing and printing somme dummy data
What did you see instead?
Nothing but
This ends up allocating 4GB from encoding/gob.(*Decoder).decodeSlice Can we have some function to set ourselves
tooBig
?Found by https://github.com/catenacyber/ngolo-fuzzing on oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50748
cc @rolandshoemaker