search

jamescourtney / FlatSharp

Fast, idiomatic C# implementation of Flatbuffers
Apache License 2.0
510 stars 51 forks source link

Add Object Depth Limit #289

Closed jamescourtney closed 2 years ago

jamescourtney commented 2 years ago

Addresses a denial of service security vulnerability where FlatSharp could be induced to stack overflow given a schema with a loop (or simply too deep) along with a malicious input.

codecov[bot] commented 2 years ago

Codecov Report

Merging #289 (02e3439) into main (593a944) will increase coverage by 0.02%. The diff coverage is 99.09%.

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #289      +/-   ##
==========================================
+ Coverage   95.63%   95.65%   +0.02%     
==========================================
  Files         113      114       +1     
  Lines        7598     7665      +67     
  Branches      706      711       +5     
==========================================
+ Hits         7266     7332      +66     
- Misses        230      231       +1     
  Partials      102      102
Impacted Files Coverage Δ
src/FlatSharp.Runtime/SerializationContext.cs 92.77% <ø> (ø)
src/FlatSharp.Runtime/SerializationHelpers.cs 93.33% <87.50%> (-2.13%) :arrow_down:
...rc/FlatSharp.Runtime/GeneratedSerializerWrapper.cs 83.91% <100.00%> (+1.08%) :arrow_up:
src/FlatSharp.Runtime/IGeneratedSerializer.cs 100.00% <100.00%> (ø)
src/FlatSharp.Runtime/IO/ArrayInputBuffer.cs 100.00% <100.00%> (ø)
...rc/FlatSharp.Runtime/IO/ArraySegmentInputBuffer.cs 100.00% <100.00%> (ø)
src/FlatSharp.Runtime/IO/MemoryInputBuffer.cs 100.00% <100.00%> (ø)
.../FlatSharp.Runtime/IO/ReadOnlyMemoryInputBuffer.cs 100.00% <100.00%> (ø)
src/FlatSharp.Runtime/Vectors/FlatBufferVector.cs 96.77% <100.00%> (ø)
.../FlatSharp.Runtime/Vectors/FlatBufferVectorBase.cs 93.81% <100.00%> (+0.13%) :arrow_up:
... and 14 more

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 593a944...02e3439. Read the comment docs.